Questions tagged [fls]

FLS - Field level security

Filter by
Sorted by
Tagged with
3
votes
1answer
29 views

Which user applies to the execution context when executing messaging.sendEmail?

I have a field that is used in an email template for which no FLS is granted in any profiles. The Apex code that sends the email using messaging.sendEmail() is invoked from a trigger so I assume it ...
1
vote
1answer
24 views

Updating a FieldPermission record produces a INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST error

I am attempting to update FLS using FieldPermission records for profiles and permission sets. This is working fine for unmanaged fields, but for managed fields I am getting an error saying that the ...
1
vote
1answer
22 views

How to Stop FLS Defaulting to Read/Write Enabled via Metadata API without Specifying fieldPermissions in Profile

I'd like to define FLS in permission sets alone and not have to maintain FLS per field in profiles. I've been surprised to find that if I do not specify in my profile that the FLS defaults to Read/...
8
votes
2answers
222 views

Get all field level permission from SOQL for an permission set

What I want to do: I am trying to create a tool in Java, which query permission sets from Salesforce Org using REST(As we do in workbench). After getting all the permission sets which field ...
1
vote
0answers
16 views

FIeld hidden by FLS no longer returns records when search terms match?

When FLS hides a field from a user, the search results would still return the record if the search term matched. https://success.salesforce.com/answers?id=9063A000000DcyUQAS This no longer seems to ...
2
votes
1answer
175 views

Disable Lightning Combobox in LWC based on FLS

I know there is a way to check if the object/field is updateable, then only it will allow the user to read or update the field like below apex : if(!Schema.SObjectType.Account.fields.Type....
1
vote
0answers
29 views

How to deploy FLS (Field Level Security) for all Objects & Fields in Scratch Org with application source push?

I'm trying to setup DX with Source code in Git and I'm pulling it from there and pushing it into a Scratch org. My Source code has multiple standard/custom objects with fields. But after Pushing code ...
-1
votes
1answer
46 views

CRUD/FLS checks on Dynamic SOQL - Needed for WHERE clause? [duplicate]

For the AppExchange Security Review, do we need to check FLS on a Dynamic SOQL WHERE clause as well? Ex: If Contact.My_Custom_Field__c is not visible to the logged in user, then the following SOQL ...
11
votes
4answers
370 views

How to best enforce CRUD/FLS and pass Security Review in 2019

Since Salesforce began to require CRUD / FLS checks as part of the Security Review for AppEchange apps in 2015 there has been a lot of discussions why this cannot be done by the platform and how this ...
3
votes
2answers
258 views

How to test CRUD and FLS in unit tests?

BACKGROUND I am working on a managed package and it contains a custom object (X__c) with one custom field (X__c.Fld__c). In the controller I check if a user has Read access to both the object and ...
2
votes
0answers
26 views

Did Salesforce remove FLS visibility for HasOptedOutOfEmail and HasOptedOutOfFax during a release update automatically?

I'm pretty sure my code was querying these some time ago inside a dynamic SOQL query. Today I can't query them anymore because FLS seems to be removed from the Admin profile that I'm using. Easy ...
4
votes
1answer
149 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
1
vote
1answer
44 views

Restrict FLS for a user when profile has access

For a certain Profile, the access to a group of fields on object is available. How can we restrict FLS for a specific user to those fields having the above mentioned same profile.
0
votes
0answers
119 views

Changing Owner before editing causes an error

Can I have a little help understanding this problem. In this scenario I always recieve an error that looks like a Field Level Security (FLS) problem but I am accessing as a System Administrator. On ...
1
vote
2answers
53 views

FLS info at User Level

I want a sheet for Field Access which User might have got through Profile or permission Set; Also wants to see if for the field user has access to is available on page layout and not restricted ...
1
vote
0answers
31 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
0
votes
2answers
213 views

Does Deleting a Custom Field Remove It From All Page Layouts?

Does Deleting a Custom Field Remove It From All Page Layouts? We have around 90 Case Page-layouts. We were recently told to remove a field from all of them. For best practices, we want to remove the ...
1
vote
1answer
102 views

FLS Create Error

My code on scanner report gives some FLS Create errors code like this public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){ if (String.isEmpty(sURL.cg__SUrl_Id__c)) { String ...
0
votes
1answer
328 views

Updating Record Name (auto-generated) using Process flow

I am working on a Developer edition. I have a custom object with an Auto-generated Record Name field. I am trying to update this field with some prefix text to make it more meaningful for the record. ...
0
votes
1answer
301 views

How to hide field from standard page layout - using lightning

I have a custom object with two fields: 1) Start_Date__c - date 2) Start_Month_Year__c - Formula(Text) When the record is view (detail) I just want to show Start_Month_Year__c (formula field) and ...
0
votes
2answers
401 views

Checkmarx Scanner is usless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
2
votes
1answer
130 views

How to enforce CRUD and FLS in bulk trigger?

How to enforce CRUD and FLS in following situation (bulk trigger). Better idea is simply throw an exception or addError(errMsg) ? trigger CaseCommentTrigger on CaseComment (after insert) { List<...
0
votes
1answer
20 views

FLS on Salesprice field

How to Remove the Access to Sales Price field on Opportuity Products. When i am trying to edit the FLS of Sales Price it is visible to all profiles and not able to change the FLS. I want to remove ...
1
vote
2answers
33 views

How do I determine by Apex code if Custom Field allows setting Field Level Security and if can be edited?

To assign correct FLS permissions in bulk for a given profile I need to know which fields are readonly and which fields support Field Level Security. I see that there is field IsFlsEnabled in ...
0
votes
1answer
125 views

CRUD FLS issue to edit task access for site guest user

I am applying CRUD FLS on task object fields and also I have provided read and edit access to task for site user profile. Even checked with sharing settings as 'Controlled by parent'. But still when ...
2
votes
0answers
63 views

Do subsequent Unlocked Package version installs deploy FLS?

I've created an Unlocked Package using Salesforce CLI and installed the first version in an org. I've checked the Field Level Security for each Profile and they were all correct. But when I changed ...
1
vote
1answer
173 views

FLS and CRUD check for User object

I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check ...
1
vote
1answer
175 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
0
votes
1answer
120 views

Not able to update RecurrenceTimeZoneSidKey field on task object

What are the work around the task object in Salesforce, i am trying to update task which is having information in the form of JavaScript object which is mentioned below and when i am trying to update ...
5
votes
1answer
162 views

CRUD & FLS on Managed Package Objects

We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to ...
0
votes
2answers
43 views

Field-level setting in the Campaign object

In my project, I create the Campaign object through Site. On public site setting, I configured (FLS)field level setting for all Custom fields in the Campaign Object. Access the site above to ...
7
votes
1answer
68 views

Is Describe Information Accurate for the Site Guest User?

As the title states, can describe information be trusted for the site guest user? Scenario I want to be able to insert/update tasks against accounts via a public Apex webservice. Yes, I'm aware of ...
8
votes
3answers
201 views

Any way to check a field's updateablity ignoring profiles?

The DescribeFieldResult.isUpdateable method incorporates the "Edit Access" setting of the Field level Security for a field i.e. it considers the field settings in the current profile. Is there a way ...
9
votes
1answer
427 views

What is the difference between creatable vs. updatable on Schema.DescribeFieldResult

When writing CRUD and FLS checks in apex I have noticed that I can check for the following: Schema.DescribeFieldResult fieldDescribe = field.getDescribe(); fieldDescribe.accessible; fieldDescribe....
1
vote
1answer
582 views

Permission Set does not override Field Level Security?

According to this documentation, Permission Sets are defining the Field Level Security. But I'm experiencing odd behavior. I'm not having access to a field, that I should be able to edit, according to ...
4
votes
1answer
194 views

Hiding Standard fields from the Record creation window - Napili Template

Seems straight forward: Field Level Security to hide the fields, but this seems like, we cannot make disable the Read permission(as it always defaults to checked): Created By, Last Modified By, Record'...
0
votes
1answer
967 views

How to retrieve FLS settings for a custom field

I have a custom field custom_field__c in Opportunity object and using APEX or metadata API (workbench) is there a way to find what are the set field level security profile is set for that given custom ...
2
votes
1answer
68 views

AppExchange ISV Security Review CRUD/FLS Puzzler

Who knows the answer to this puzzler? Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need ...
2
votes
1answer
509 views

CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check ...
2
votes
0answers
60 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
1
vote
0answers
114 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
0
votes
2answers
295 views

Service Contract is not showing up in Lightning

I am working on field service lightning , I am able see Service contract (Standard object)in salesforce classic but when i switch to salesforce Lightning then Service contract object is not visible . ...
6
votes
1answer
84 views

Does SObjectType Access Guarantee Id Access?

I am writing a fluent query builder which I hope will pass security review, and I still have a few nagging questions. I will refrain from asking more than one question per question, so right now, what ...
0
votes
2answers
493 views

how to check FLS of sObject dynamically

if(Schema.Accountr__c.getSObjectType().getDescribe().isAccessible()) In the Above line, I am checking whether that Accountr__c object data is accessible or not. My query is, can I check the FLS of ...
0
votes
2answers
707 views

How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?

I recently run into a problem when I try to check fls within an without sharing class. Here is what I did: For the user profile I set CustomObject__c allow delete permission to "False" public ...
2
votes
1answer
207 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
1
vote
1answer
145 views

How to cache CRUD/FLS access checks

In the Connect to Salesforce with Server-Side Controllers module on trailhead, when advising of the requirement to do CRUD/FLS checks, the author cautions: Also, describe calls are expensive. If ...
5
votes
2answers
2k views

Field-Level Security (FLS) in Lightning Components

I'm going through CRUD and Field-Level Security (FLS) from Lightning Components Developer Guide, and the following code for Field-Level Security validation doesn't make any sense for me in terms of ...
3
votes
1answer
343 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
2
votes
1answer
738 views

Sample test for testing FLS/CRUD

I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new ...