The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [fls]

FLS - Field level security

Filter by
Sorted by
Tagged with
0
votes
1answer
28 views

Disable Lightning Combobox in LWC based on FLS

I know there is a way to check if the object/field is updateable, then only it will allow the user to read or update the field like below apex : if(!Schema.SObjectType.Account.fields.Type....
0
votes
0answers
21 views

How to deploy FLS (Field Level Security) for all Objects & Fields in Scratch Org with application source push?

I'm trying to setup DX with Source code in Git and I'm pulling it from there and pushing it into a Scratch org. My Source code has multiple standard/custom objects with fields. But after Pushing code ...
-1
votes
1answer
29 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...
9
votes
3answers
233 views

How to best enforce CRUD/FLS and pass Security Review in 2019

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
3
votes
2answers
135 views

How to test CRUD and FLS in unit tests?

BACKGROUND I am working on a managed package and it contains a custom object (X__c) with one custom field (X__c.Fld__c). In the controller I check if a user has Read access to both the object and ...
2
votes
0answers
21 views

Did Salesforce remove FLS visibility for HasOptedOutOfEmail and HasOptedOutOfFax during a release update automatically?

I'm pretty sure my code was querying these some time ago inside a dynamic SOQL query. Today I can't query them anymore because FLS seems to be removed from the Admin profile that I'm using. Easy ...
4
votes
1answer
125 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
1
vote
1answer
34 views

Restrict FLS for a user when profile has access

For a certain Profile, the access to a group of fields on object is available. How can we restrict FLS for a specific user to those fields having the above mentioned same profile.
0
votes
0answers
95 views

Changing Owner before editing causes an error

Can I have a little help understanding this problem. In this scenario I always recieve an error that looks like a Field Level Security (FLS) problem but I am accessing as a System Administrator. On ...
1
vote
2answers
49 views

FLS info at User Level

I want a sheet for Field Access which User might have got through Profile or permission Set; Also wants to see if for the field user has access to is available on page layout and not restricted ...
1
vote
0answers
31 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
0
votes
2answers
96 views

Does Deleting a Custom Field Remove It From All Page Layouts?

Does Deleting a Custom Field Remove It From All Page Layouts? We have around 90 Case Page-layouts. We were recently told to remove a field from all of them. For best practices, we want to remove the ...
1
vote
1answer
89 views

FLS Create Error

My code on scanner report gives some FLS Create errors code like this public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){ if (String.isEmpty(sURL.cg__SUrl_Id__c)) { String ...
0
votes
1answer
180 views

Updating Record Name (auto-generated) using Process flow

I am working on a Developer edition. I have a custom object with an Auto-generated Record Name field. I am trying to update this field with some prefix text to make it more meaningful for the record. ...
0
votes
1answer
252 views

How to hide field from standard page layout - using lightning

I have a custom object with two fields: 1) Start_Date__c - date 2) Start_Month_Year__c - Formula(Text) When the record is view (detail) I just want to show Start_Month_Year__c (formula field) and ...
0
votes
2answers
310 views

Checkmarx Scanner is usless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
2
votes
1answer
106 views

How to enforce CRUD and FLS in bulk trigger?

How to enforce CRUD and FLS in following situation (bulk trigger). Better idea is simply throw an exception or addError(errMsg) ? trigger CaseCommentTrigger on CaseComment (after insert) { List<...
0
votes
1answer
19 views

FLS on Salesprice field

How to Remove the Access to Sales Price field on Opportuity Products. When i am trying to edit the FLS of Sales Price it is visible to all profiles and not able to change the FLS. I want to remove ...
1
vote
2answers
31 views

How do I determine by Apex code if Custom Field allows setting Field Level Security and if can be edited?

To assign correct FLS permissions in bulk for a given profile I need to know which fields are readonly and which fields support Field Level Security. I see that there is field IsFlsEnabled in ...
0
votes
1answer
94 views

CRUD FLS issue to edit task access for site guest user

I am applying CRUD FLS on task object fields and also I have provided read and edit access to task for site user profile. Even checked with sharing settings as 'Controlled by parent'. But still when ...
2
votes
0answers
60 views

Do subsequent Unlocked Package version installs deploy FLS?

I've created an Unlocked Package using Salesforce CLI and installed the first version in an org. I've checked the Field Level Security for each Profile and they were all correct. But when I changed ...
1
vote
1answer
151 views

FLS and CRUD check for User object

I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check ...
1
vote
1answer
139 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
0
votes
1answer
104 views

Not able to update RecurrenceTimeZoneSidKey field on task object

What are the work around the task object in Salesforce, i am trying to update task which is having information in the form of JavaScript object which is mentioned below and when i am trying to update ...
5
votes
1answer
142 views

CRUD & FLS on Managed Package Objects

We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to ...
0
votes
2answers
42 views

Field-level setting in the Campaign object

In my project, I create the Campaign object through Site. On public site setting, I configured (FLS)field level setting for all Custom fields in the Campaign Object. Access the site above to ...
7
votes
1answer
64 views

Is Describe Information Accurate for the Site Guest User?

As the title states, can describe information be trusted for the site guest user? Scenario I want to be able to insert/update tasks against accounts via a public Apex webservice. Yes, I'm aware of ...
8
votes
3answers
178 views

Any way to check a field's updateablity ignoring profiles?

The DescribeFieldResult.isUpdateable method incorporates the "Edit Access" setting of the Field level Security for a field i.e. it considers the field settings in the current profile. Is there a way ...
9
votes
1answer
372 views

What is the difference between creatable vs. updatable on Schema.DescribeFieldResult

When writing CRUD and FLS checks in apex I have noticed that I can check for the following: Schema.DescribeFieldResult fieldDescribe = field.getDescribe(); fieldDescribe.accessible; fieldDescribe....
1
vote
1answer
516 views

Permission Set does not override Field Level Security?

According to this documentation, Permission Sets are defining the Field Level Security. But I'm experiencing odd behavior. I'm not having access to a field, that I should be able to edit, according to ...
4
votes
1answer
176 views

Hiding Standard fields from the Record creation window - Napili Template

Seems straight forward: Field Level Security to hide the fields, but this seems like, we cannot make disable the Read permission(as it always defaults to checked): Created By, Last Modified By, Record'...
0
votes
1answer
838 views

How to retrieve FLS settings for a custom field

I have a custom field custom_field__c in Opportunity object and using APEX or metadata API (workbench) is there a way to find what are the set field level security profile is set for that given custom ...
2
votes
1answer
65 views

AppExchange ISV Security Review CRUD/FLS Puzzler

Who knows the answer to this puzzler? Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need ...
2
votes
1answer
426 views

CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check ...
2
votes
0answers
60 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
1
vote
0answers
108 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
0
votes
2answers
256 views

Service Contract is not showing up in Lightning

I am working on field service lightning , I am able see Service contract (Standard object)in salesforce classic but when i switch to salesforce Lightning then Service contract object is not visible . ...
6
votes
1answer
81 views

Does SObjectType Access Guarantee Id Access?

I am writing a fluent query builder which I hope will pass security review, and I still have a few nagging questions. I will refrain from asking more than one question per question, so right now, what ...
0
votes
2answers
447 views

how to check FLS of sObject dynamically

if(Schema.Accountr__c.getSObjectType().getDescribe().isAccessible()) In the Above line, I am checking whether that Accountr__c object data is accessible or not. My query is, can I check the FLS of ...
0
votes
2answers
518 views

How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?

I recently run into a problem when I try to check fls within an without sharing class. Here is what I did: For the user profile I set CustomObject__c allow delete permission to "False" public ...
2
votes
1answer
193 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
1
vote
1answer
140 views

How to cache CRUD/FLS access checks

In the Connect to Salesforce with Server-Side Controllers module on trailhead, when advising of the requirement to do CRUD/FLS checks, the author cautions: Also, describe calls are expensive. If ...
5
votes
2answers
2k views

Field-Level Security (FLS) in Lightning Components

I'm going through CRUD and Field-Level Security (FLS) from Lightning Components Developer Guide, and the following code for Field-Level Security validation doesn't make any sense for me in terms of ...
3
votes
1answer
328 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
2
votes
1answer
662 views

Sample test for testing FLS/CRUD

I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new ...
4
votes
1answer
1k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object ...
43
votes
2answers
5k views

Lightning Experience: How to prevent the display of obsolete data?

In many cases I've seen that LE is not displaying recent changes made in Setup immediately like in Salesforce Classic, but somehow cached or delayed. Yesterday I found an easy and perfectly ...
1
vote
1answer
374 views

FLS Create for upsert

How manage FLS Create issues in Checkmarx for upsert statements ? I use isCreateable() for insert and isUpdateable() for update. But for upsert, I don't know what function I have to use (one or both)...
0
votes
1answer
611 views

Enforcing CRUD / FLS / Sharing in Apex

I am having trouble putting the different aspects of enforcing CRUD/FLS/Sharing Rules into perspective. Reading through the manuals and doing extensive tests on my own, I came to the following ...
3
votes
1answer
110 views

Why is Field Level Security at the object-level presented as “Visible / Read-only” instead of “read / edit”?

If you access FLS settings for a given profile, it lists all the "edit" and "read" permissions for all fields in any object. If accessing the FLS settings from the object by clicking the "Field Level ...