Questions tagged [fls]

FLS - Field level security

40
votes
2answers
5k views

Lightning Experience: How to prevent the display of obsolete data?

In many cases I've seen that LE is not displaying recent changes made in Setup immediately like in Salesforce Classic, but somehow cached or delayed. Yesterday I found an easy and perfectly ...
9
votes
1answer
297 views

What is the difference between creatable vs. updatable on Schema.DescribeFieldResult

When writing CRUD and FLS checks in apex I have noticed that I can check for the following: Schema.DescribeFieldResult fieldDescribe = field.getDescribe(); fieldDescribe.accessible; fieldDescribe....
8
votes
1answer
609 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
8
votes
3answers
161 views

Any way to check a field's updateablity ignoring profiles?

The DescribeFieldResult.isUpdateable method incorporates the "Edit Access" setting of the Field level Security for a field i.e. it considers the field settings in the current profile. Is there a way ...
7
votes
3answers
589 views

Platform Encryption vs. FLS

What would I get from Platform Encryption that I cannot get from Field Level Security? We are investigating whether or not to invest in Salesforce Shield, so I want to better understand the ...
7
votes
1answer
61 views

Is Describe Information Accurate for the Site Guest User?

As the title states, can describe information be trusted for the site guest user? Scenario I want to be able to insert/update tasks against accounts via a public Apex webservice. Yes, I'm aware of ...
6
votes
1answer
78 views

Does SObjectType Access Guarantee Id Access?

I am writing a fluent query builder which I hope will pass security review, and I still have a few nagging questions. I will refrain from asking more than one question per question, so right now, what ...
5
votes
2answers
797 views

Do we allow CRUD & FLS in each component of Apex?

Can I write CRUD & FLS Enforecement codes in following : If not in any of these - then Why ? Apex Class - YES Apex Trigger - ? Apex BatchClasses - ? Utility Classes - ?
5
votes
1answer
113 views

CRUD & FLS on Managed Package Objects

We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to ...
5
votes
1answer
528 views

Security Review - CRUD/FLS Checks for every SOQL Query

I know this sounds like a standard question, so please bear with me. Recently our Security Reviews fail due to CRUD/FLS violations. The highlighted codelines include almost every SOQL Query in the ...
4
votes
1answer
477 views

Better way for Bulk Assignment of Field Level Security

In Salesforce we have a custom object which has 500 fields. We have around 50 different profiles in our org. Out of this 50 profiles, 30 profiles need access to these fields. Right now, to set field ...
4
votes
1answer
1k views

Field-Level Security (FLS) in Lightning Components

I'm going through CRUD and Field-Level Security (FLS) from Lightning Components Developer Guide, and the following code for Field-Level Security validation doesn't make any sense for me in terms of ...
4
votes
1answer
162 views

Hiding Standard fields from the Record creation window - Napili Template

Seems straight forward: Field Level Security to hide the fields, but this seems like, we cannot make disable the Read permission(as it always defaults to checked): Created By, Last Modified By, Record'...
4
votes
1answer
1k views

How to resolve FLS Create and FLS Update issue as per security scanner

Running the Security Scanner showed the Following Issues In order to avoid it I tried adding the following line if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())- For object ...
3
votes
1answer
58 views

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

I've been using FFLIB_SecurityUtils lib to enforce CRUD and FLS in my apex classes. I've no issues when running unit tests, but when submitting my code on Source Scanner for partners, i've several ...
3
votes
2answers
594 views

CRUD and FLS enforcement

I have an Account list and I want to update it. I want to testing object and field level security enforcement but I'm wondering what I have to test : 1 - if Account object is updatable ? (if it's ...
3
votes
1answer
309 views

CRUD FLS enforcements and best practices

I have written a basic controller class which does insert/delete/update. I wanted to validate whether I'm thinking about CRUD/FLS enforcements the right way. Also wanted to know what are the best ...
3
votes
1answer
98 views

What determines the default FLS settings when creating a new field

In step 3 of the create new field wizard, you are presented with a page like this: Why do some of the profiles get default visibility and some don't? There is probably an extremely simple profile ...
3
votes
1answer
137 views

FLS behaviour different between API and GUI/Apex

Assume Contact.DoNotCall and Opportunity.ContractId are FLS invisible for the standard profile "System Administrator". Both fields are visible in the setup and are reported by describe calls in Apex ...
3
votes
1answer
79 views

Why is Field Level Security at the object-level presented as “Visible / Read-only” instead of “read / edit”?

If you access FLS settings for a given profile, it lists all the "edit" and "read" permissions for all fields in any object. If accessing the FLS settings from the object by clicking the "Field Level ...
2
votes
1answer
59 views

AppExchange ISV Security Review CRUD/FLS Puzzler

Who knows the answer to this puzzler? Q: If a Visualforce Page is using a standard controller with a custom controller extension and the controller extension is declared "with sharing", do we need ...
2
votes
1answer
91 views

How to enforce CRUD and FLS in bulk trigger?

How to enforce CRUD and FLS in following situation (bulk trigger). Better idea is simply throw an exception or addError(errMsg) ? trigger CaseCommentTrigger on CaseComment (after insert) { List<...
2
votes
1answer
337 views

CRUD/FLS Enforcement: how to add isAccessible() to the test class for code coverage

I received the result from security review from Salesforce team and it failed. One of the vulnerability shown in the report was CRUD/FLS Enforcement. The report suggest I use the isAccessible() check ...
2
votes
2answers
741 views

How to restrict read only field on visualforce page to edit using Inline edit functionality

I have provided standard inline edit functionality on the visualforce page. I want to restrict the user to edit the field if he/she has not edit access on it. I have set FLS as read only for these ...
2
votes
1answer
53 views

If object is private but its lookup allows Read, what will happen?

What will be the access level for the lookup field in these 2 scenarios: MyObject is private, object-level permissions allow Read, and lookup to MyObject allows Read Same as 1 but object-level ...
2
votes
0answers
16 views

Did Salesforce remove FLS visibility for HasOptedOutOfEmail and HasOptedOutOfFax during a release update automatically?

I'm pretty sure my code was querying these some time ago inside a dynamic SOQL query. Today I can't query them anymore because FLS seems to be removed from the Admin profile that I'm using. Easy ...
2
votes
0answers
58 views

CRUD-FLS Implementation for Event Object

We are creating a managed package and have submitted for Security review process. We had implemented CRUD-FLS check on all the objects we had used within our application except EVENT. But we had ...
2
votes
1answer
181 views

Enforce FLS/CRUD Delete issue in security scan

I am getting problem in understanding a issue given by security scan. The problem is : [] I am not pasting the whole code but the essential lines: public with sharing class ...
2
votes
0answers
99 views

Why Field Accessibility Check is broken in a Managed Package?

my code has a centralised class which is responsible for all DML operations. This class before inserting / updating / deleting a record is checking: 1, if the object is accessible for the current ...
1
vote
3answers
2k views

How do I check CRUD and FLS in apex?

Please help me solving this Issue. I'm new to the salesforce, I worte an Controller which do get list of objects values from contact, Cases and also inserts New cases and Case comments to, During the ...
1
vote
2answers
572 views

Is it possible to change Field Level Security with Workflows

How can I show a hidden field to a user after triggering a workflow which will evaluate on certain condition and will decide either this field need to be visible or not?
1
vote
1answer
22 views

Restrict FLS for a user when profile has access

For a certain Profile, the access to a group of fields on object is available. How can we restrict FLS for a specific user to those fields having the above mentioned same profile.
1
vote
1answer
55 views

FLS Create Error

My code on scanner report gives some FLS Create errors code like this public static cg__SURL__c upsertPublicLink(cg__SURL__c sUrl){ if (String.isEmpty(sURL.cg__SUrl_Id__c)) { String ...
1
vote
1answer
343 views

FLS Create for upsert

How manage FLS Create issues in Checkmarx for upsert statements ? I use isCreateable() for insert and isUpdateable() for update. But for upsert, I don't know what function I have to use (one or both)...
1
vote
1answer
99 views

Deploying Fields (new or pre-existing) - Security

I haven't been doing Deployments for over a year now in Salesforce (my role, and company, have significantly changed). However, where I now work, I have developers telling me they CAN NOT DEPLOY ...
1
vote
1answer
92 views

Custom Button visibility on Page layout dependent on FLS of some field

Is it possible to control Custom Button visibility on Standard Page layout depending on FLS of some field? Or any other way? Please advise.
1
vote
1answer
35 views

Which permission is needed for a profile to be able to edit/set FLS

I am hitting a brick wall. Just can't find which permission needs to be enabled on a profile to allow assigned users to set up and/or edit FLS. The issue is that due to policy restrictions I can't ...
1
vote
2answers
43 views

FLS info at User Level

I want a sheet for Field Access which User might have got through Profile or permission Set; Also wants to see if for the field user has access to is available on page layout and not restricted ...
1
vote
1answer
133 views

FLS and CRUD check for User object

I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check ...
1
vote
1answer
94 views

check FLS and CRUD for more than one field

I have a code which inserts custom Note__c object by using 5 fields. I want to check FLS and CRUD permission field level wise as they are reported in the checkmarx report. I know we can write in if ...
1
vote
1answer
131 views

How to cache CRUD/FLS access checks

In the Connect to Salesforce with Server-Side Controllers module on trailhead, when advising of the requirement to do CRUD/FLS checks, the author cautions: Also, describe calls are expensive. If ...
1
vote
1answer
562 views

Sample test for testing FLS/CRUD

I'm trying to understand FLS/CRUD permissions using a simple test. I have created a user and assigned a no-update,no-delete,no-create permission set on that. In my test I'm trying to run as this new ...
1
vote
2answers
720 views

The post install script failed

We've the following post install script in place. We have recently updated it to check for FLS CRUD validation as Checkmarx scan suggested. Does custom settings need to have this FLS CRUD validation?...
1
vote
1answer
628 views

Migrating Fields added to report types using ANT

Question 1: I have added few fields in custom report types in UAT. Can i move these changes using ANT tool to PRODUCTION? Usually after deployment, we manually add fields in Report Types in ...
1
vote
0answers
30 views

CRUD/FLS Enforcement for configuration tables like FiscalYearSettings

Is Field Level Security enforcement a requirement for querying tables like 'FiscalYearSettings' and 'Period'? or only for tables like Opportunity and Contact. Our app need to display the fiscal year ...
1
vote
2answers
27 views

How do I determine by Apex code if Custom Field allows setting Field Level Security and if can be edited?

To assign correct FLS permissions in bulk for a given profile I need to know which fields are readonly and which fields support Field Level Security. I see that there is field IsFlsEnabled in ...
1
vote
0answers
56 views

Do subsequent Unlocked Package version installs deploy FLS?

I've created an Unlocked Package using Salesforce CLI and installed the first version in an org. I've checked the Field Level Security for each Profile and they were all correct. But when I changed ...
1
vote
0answers
417 views

Permission Set does not override Field Level Security?

According to this documentation, Permission Sets are defining the Field Level Security. But I'm experiencing odd behavior. I'm not having access to a field, that I should be able to edit, according to ...
1
vote
0answers
100 views

FLS/CRUD Enforcement In Helper Classes

We have several controller classes that call out to helper classes to grab data or save data. This has resulted in a few questions... Is it sufficient to simply check all permissions in the ...
1
vote
0answers
492 views

deploying Field level security

what is different from force.com 28 to 31? i was able to move the field level security using force.com 28 without adding profiles to the package. but with the newer versions of Force.com >= 31 it is ...