Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fls]

FLS - Field level security

1
vote
1answer
21 views

Restrict FLS for a user when profile has access

For a certain Profile, the access to a group of fields on object is available. How can we restrict FLS for a specific user to those fields having the above mentioned same profile.
0
votes
0answers
43 views

Changing Owner before editing causes an error

Can I have a little help understanding this problem. In this scenario I always recieve an error that looks like a Field Level Security (FLS) problem but I am accessing as a System Administrator. On ...
1
vote
2answers
43 views

FLS info at User Level

I want a sheet for Field Access which User might have got through Profile or permission Set; Also wants to see if for the field user has access to is available on page layout and not restricted ...
1
vote
0answers
30 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
0
votes
2answers
39 views

Does Deleting a Custom Field Remove It From All Page Layouts?

Does Deleting a Custom Field Remove It From All Page Layouts? We have around 90 Case Page-layouts. We were recently told to remove a field from all of them. For best practices, we want to remove the ...
1
vote
1answer
53 views

FLS Create Error

My code on scanner report gives some FLS Create errors code like this public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){ if (String.isEmpty(sURL.cg__SUrl_Id__c)) { String ...
0
votes
1answer
62 views

Updating Record Name (auto-generated) using Process flow

I am working on a Developer edition. I have a custom object with an Auto-generated Record Name field. I am trying to update this field with some prefix text to make it more meaningful for the record. ...
0
votes
1answer
153 views

How to hide field from standard page layout - using lightning

I have a custom object with two fields: 1) Start_Date__c - date 2) Start_Month_Year__c - Formula(Text) When the record is view (detail) I just want to show Start_Month_Year__c (formula field) and ...
0
votes
2answers
182 views

Checkmarx Scanner is usless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
2
votes
1answer
90 views

How to enforce CRUD and FLS in bulk trigger?

How to enforce CRUD and FLS in following situation (bulk trigger). Better idea is simply throw an exception or addError(errMsg) ? trigger CaseCommentTrigger on CaseComment (after insert) { List<...
0
votes
1answer
18 views

FLS on Salesprice field

How to Remove the Access to Sales Price field on Opportuity Products. When i am trying to edit the FLS of Sales Price it is visible to all profiles and not able to change the FLS. I want to remove ...
1
vote
2answers
26 views

How do I determine by Apex code if Custom Field allows setting Field Level Security and if can be edited?

To assign correct FLS permissions in bulk for a given profile I need to know which fields are readonly and which fields support Field Level Security. I see that there is field IsFlsEnabled in ...
0
votes
1answer
62 views

CRUD FLS issue to edit task access for site guest user

I am applying CRUD FLS on task object fields and also I have provided read and edit access to task for site user profile. Even checked with sharing settings as 'Controlled by parent'. But still when ...
1
vote
0answers
52 views

Do subsequent Unlocked Package version installs deploy FLS?

I've created an Unlocked Package using Salesforce CLI and installed the first version in an org. I've checked the Field Level Security for each Profile and they were all correct. But when I changed ...
1
vote
1answer
123 views

FLS and CRUD check for User object

I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check ...
1
vote
1answer
88 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
0
votes
1answer
76 views

Not able to update RecurrenceTimeZoneSidKey field on task object

What are the work around the task object in Salesforce, i am trying to update task which is having information in the form of JavaScript object which is mentioned below and when i am trying to update ...
4
votes
1answer
100 views

CRUD & FLS on Managed Package Objects

We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to ...
0
votes
2answers
39 views

Field-level setting in the Campaign object

In my project, I create the Campaign object through Site. On public site setting, I configured (FLS)field level setting for all Custom fields in the Campaign Object. Access the site above to ...
7
votes
1answer
60 views

Is Describe Information Accurate for the Site Guest User?

As the title states, can describe information be trusted for the site guest user? Scenario I want to be able to insert/update tasks against accounts via a public Apex webservice. Yes, I'm aware of ...
8
votes
3answers
156 views

Any way to check a field's updateablity ignoring profiles?

The DescribeFieldResult.isUpdateable method incorporates the "Edit Access" setting of the Field level Security for a field i.e. it considers the field settings in the current profile. Is there a way ...
9
votes
1answer
281 views

What is the difference between creatable vs. updatable on Schema.DescribeFieldResult

When writing CRUD and FLS checks in apex I have noticed that I can check for the following: Schema.DescribeFieldResult fieldDescribe = field.getDescribe(); fieldDescribe.accessible; fieldDescribe....
1
vote
0answers
395 views

Permission Set does not override Field Level Security?

According to this documentation, Permission Sets are defining the Field Level Security. But I'm experiencing odd behavior. I'm not having access to a field, that I should be able to edit, according to ...
4
votes
1answer
160 views

Hiding Standard fields from the Record creation window - Napili Template

Seems straight forward: Field Level Security to hide the fields, but this seems like, we cannot make disable the Read permission(as it always defaults to checked): Created By, Last Modified By, Record'...
0
votes
1answer
599 views

How to retrieve FLS settings for a custom field

I have a custom field custom_field__c in Opportunity object and using APEX or metadata API (workbench) is there a way to find what are the set field level security profile is set for that given custom ...
1
vote
1answer
56 views

AppExchange ISV Security Review CRUD/FLS Puzzler

Who knows the answer to this puzzler? Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need ...
2
votes
1answer
326 views

CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check ...
2
votes
0answers
58 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
1
vote
0answers
99 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
0
votes
2answers
221 views

Service Contract is not showing up in Lightning

I am working on field service lightning , I am able see Service contract (Standard object)in salesforce classic but when i switch to salesforce Lightning then Service contract object is not visible . ...
6
votes
1answer
78 views

Does SObjectType Access Guarantee Id Access?

I am writing a fluent query builder which I hope will pass security review, and I still have a few nagging questions. I will refrain from asking more than one question per question, so right now, what ...
0
votes
2answers
340 views

how to check FLS of sObject dynamically

if(Schema.Accountr__c.getSObjectType().getDescribe().isAccessible()) In the Above line, I am checking whether that Accountr__c object data is accessible or not. My query is, can I check the FLS of ...
0
votes
2answers
403 views

How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?

I recently run into a problem when I try to check fls within an without sharing class. Here is what I did: For the user profile I set CustomObject__c allow delete permission to "False" public ...
2
votes
1answer
180 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
1
vote
1answer
131 views

How to cache CRUD/FLS access checks

In the Connect to Salesforce with Server-Side Controllers module on trailhead, when advising of the requirement to do CRUD/FLS checks, the author cautions: Also, describe calls are expensive. If ...
4
votes
1answer
1k views

Field-Level Security (FLS) in Lightning Components

I'm going through CRUD and Field-Level Security (FLS) from Lightning Components Developer Guide, and the following code for Field-Level Security validation doesn't make any sense for me in terms of ...
2
votes
1answer
300 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
1
vote
1answer
540 views

Sample test for testing FLS/CRUD

I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new ...
4
votes
1answer
1k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object ...
40
votes
2answers
5k views

Lightning Experience: How to prevent the display of obsolete data?

In many cases I've seen that LE is not displaying recent changes made in Setup immediately like in Salesforce Classic, but somehow cached or delayed. Yesterday I found an easy and perfectly ...
1
vote
1answer
338 views

FLS Create for upsert

How manage FLS Create issues in Checkmarx for upsert statements ? I use isCreateable() for insert and isUpdateable() for update. But for upsert, I don't know what function I have to use (one or both)...
0
votes
1answer
436 views

Enforcing CRUD / FLS / Sharing in Apex

I am having trouble putting the different aspects of enforcing CRUD/FLS/Sharing Rules into perspective. Reading through the manuals and doing extensive tests on my own, I came to the following ...
3
votes
1answer
71 views

Why is Field Level Security at the object-level presented as “Visible / Read-only” instead of “read / edit”?

If you access FLS settings for a given profile, it lists all the "edit" and "read" permissions for all fields in any object. If accessing the FLS settings from the object by clicking the "Field Level ...
4
votes
1answer
518 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
0
votes
1answer
680 views

Custom field as made Read only via Field level security and same Custom field as Required in Page layout

A custom field is made Read only from the Field level security and Required from Page layout. I can see the Field as Read Only for the User. Why it is happening? Is it because the Field level security ...
1
vote
2answers
697 views

The post install script failed

We've the following post install script in place. We have recently updated it to check for FLS CRUD validation as Checkmarx scan suggested. Does custom settings need to have this FLS CRUD validation?...
8
votes
1answer
599 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
2
votes
2answers
735 views

How to restrict read only field on visualforce page to edit using Inline edit functionality

I have provided standard inline edit functionality on the visualforce page. I want to restrict the user to edit the field if he/she has not edit access on it. I have set FLS as read only for these ...
1
vote
1answer
95 views

Deploying Fields (new or pre-existing) - Security

I haven't been doing Deployments for over a year now in Salesforce (my role, and company, have significantly changed). However, where I now work, I have developers telling me they CAN NOT DEPLOY ...
1
vote
1answer
91 views

Custom Button visibility on Page layout dependent on FLS of some field

Is it possible to control Custom Button visibility on Standard Page layout depending on FLS of some field? Or any other way? Please advise.