Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

Automate.IO and maybe Groove - what are these things?

Over the last six months we have seen a little over 2,800 logins to our SFDC org by an app called 'automate.io' and another called 'Groove'. The IP addresses on the logins point to places like ...
1
vote
1answer
18 views

not checking for Id in FLS checks before query and DML [duplicate]

I am not checking for Id in FLS checks before query and DML. Is this a security review vulnerability in salesforce?
0
votes
1answer
32 views

Performing DML from a aura component's init handler [closed]

Performing DML from a aura component's init handler and the component is firing from a quick action of a record detail. Is this a security vulnerability for salesforce? Points to consider: The ...
4
votes
1answer
50 views

Why is stripInaccessible removing an M-D field?

I am building and LWC which uses lightning-record-edit-form to create an object, then calls an Apex controller method to create a list of M-D children of the newly created object. In my current test, ...
0
votes
0answers
17 views

Cannot get custom font to work in Community Pages- have tried many things to fix

I followed these instructions to the letter in my Dev Org: https://developer.salesforce.com/docs/atlas.en-us.communities_dev.meta/communities_dev/communities_dev_customize_font.htm I've tried ...
0
votes
0answers
28 views

Winter '21 LWC “script-src” issue with lightning-record-form

We have an LWC component that leverages the lightning-record-form to allow records of a specific custom object to be created or edited. The form uses an object layout to define the fields to edit, and ...
0
votes
0answers
19 views

connecting roles to records

In this tutorial, the instructor configures roles hierarchies, but in don't have the same options of what to do with them: tutorial: Who Sees What: Record Access Via Roles (Lightning Experience) Her ...
4
votes
3answers
73 views

What is the risk of not performing Field Level Security (FLS) checks on internally developed Apex code?

I see more and more information about the importance of performing FLS checks before SOQL and DML operations, using the Security.stripInaccessible method, e.g. in the Winter '21 PD1 certification ...
1
vote
1answer
32 views

How to implement PKCE flow in Salesforce

I am using PKCE ( proof key for code exchange ) flow in salesforce and trying to authenticate but getting below error { "error": "invalid_grant", "error_description": &...
1
vote
1answer
32 views

PCKE flow Salesforce for OAuth 2.0

I am using PKCE ( proof key for code exchange ) flow in salesforce and trying to authenticate but getting below error { "error": "invalid_grant", "error_description": &...
0
votes
0answers
21 views

Private Settings managed packaged issue

Have someone ever faced package named Private Settings? There is need to take a glance at the classes methods if it possible. I'm gonna use that one to reach out custom API but don't have a clear idea ...
4
votes
3answers
126 views

How to see encrypted field in System mode?

I can see and use encrypted field in user mode with View Encrypted Data permission. But in System mode it always as "stars" (***********). Is it possible to see it in the System mode as ...
0
votes
0answers
31 views

Automatically Running Salesforce Data masking package

I have a task to automatically run the Data mask package provided by Salesforce after sandbox get refresh. I am looking to write a batch apex but how should I do it . Can I run by accessing the ...
-1
votes
1answer
16 views

split userPassword and securityToken

Let's say we have 3rd party api that should reach salesforce. we want to transfer password and security token in using only one custom http header. is it possible to split these values? e.g. ...
0
votes
1answer
45 views

Why does the FFLIB framework enforce CRUD security and sharing rules by default for Domains?

In FFLIB, a Domain enforces CRUD security and sharing rules by default. We use FFLIB Domains for implementing triggers. In the Salesforce standard, triggers run in system context, meaning they don't ...
1
vote
0answers
45 views

File not showing preview when created by Force.com Site Guest User (i think after Summer '20 Release)

I saw that since Summer 20 changes to the rights of the Force.com Site have taken place (https://releasenotes.docs.salesforce.com/en-us/spring20/release-notes/rn_networks_guest_user.htm) Currently I ...
0
votes
0answers
12 views

Opportunity Sharing Rule creation option not available

In one of my org I changed the OWD for Opportunity from Public Read Only to Private. However, I can't see the option to create a new sharing rule for Opportunity. What could be the possible reason for ...
0
votes
0answers
27 views

Grant View All Accounts permission for a Community User

We have a community and community users holds customer community login profile. Basically, Account and ChildObject__c have been shared with community users with a sharing set according to the below ...
0
votes
1answer
24 views

How can I give read access to User for users on a Customer Community licence?

I have a lookup field called Requested_By__c which looks up to User. It is on a custom object called Sample__c. In my LWC (sampleHelpInfo) I am using @wire to get the sample record and the ID of the ...
1
vote
0answers
7 views

Individual lightning Dashboard access to users

I have a requirement where there are specific users who should have view access only to few dashboards in a folder but not all. I know that we can manage folder access but is there any way we can ...
0
votes
1answer
40 views

Retrieving record IDs after inserting a List of objects [duplicate]

I Have used Enforce Security With the stripInaccessible Method to Create Record in Account Object List<Account> newAccounts = new List<Account>(); Account a = new Account(Name='Acme ...
9
votes
0answers
111 views

Font Awesome fonts are not being loaded after “Enable Secure Static Resources” activated for testing

Recently I have encountered the feature "Enable Secure Static Resources" on the release update (that was already being postponed as I am writing this) and read this question talking about it ...
14
votes
0answers
801 views

What is the impact of the Release Update: “Enable Secure Static Resources for Lightning Components”? (due 2020-11-29)

On the Release Update page in the setup (/lightning/setup/ReleaseUpdates/home) I found this Enable Secure Static Resources for Lightning Components COMPLETE STEPS BY: 29.11.2020 TEST RUN SUPPORTED To ...
1
vote
0answers
30 views

Will deprecated classes raise any security issues?

I submitted my managed package for a security review few days ago. After submitting, I found out that I don't have to use an Apex class in the package. So, I tried to delete that class but couldn't ...
2
votes
1answer
27 views

Why are Apex Class Permissions being enforced in sandbox but not in production?

In our full sandbox, our QA engineer has observed that one of our Lightning Components is failing. Upon further inspection, it turns out that the Apex class the component is calling is not accessible ...
0
votes
0answers
26 views

Keeping a ViewAllData permissionset viewing all fields

I have a permissionset which I want to grant broad read-only access to nearly all fields and objects. I've granted the permissionset the ViewAllData permission already, but that permission does not ...
0
votes
1answer
45 views

How to use variables in JavaScript without exposing them in the browser?

I want to use the Bee Template API inside my Visualforce page. So, this is the code I used: //Visualforce Page <apex:page showHeader="false" controller="...
0
votes
1answer
65 views

Is there some standardized way to ensure custom settings are not automatically cloned into Sandboxes?

Among other things, our custom settings include URLs for production servers and credentials to access those servers. Arguably, some of these things should probably be Named Credentials, but the ...
0
votes
1answer
37 views

Best way to limit visibility to Synchronized Data Extensions in Dev Org?

What is the best way to limit the visibility to Synchronized Data Extensions as well as their ability to view the Synchronized Data Sources & Objects in Marketing Cloud from other users? Do we use ...
0
votes
0answers
20 views

Approval Email Notification Template Is Not Triggered By All Users

I have created an Approval submission email notification template in Dev sandbox. This is working for all the users who ever submit the approval process, email is submitted to queue members/queue ...
3
votes
1answer
64 views

FLS check in 2GP

I've created a new 2GP package. Since it is going to be released to AppExchange, I've implemented a generic CRUD and FLS check for every place I contact with the Database in my Apex code. e.g. ...
2
votes
2answers
58 views

Does a library exist for securely querying for arbitrary data?

I'm looking for a library we can use from Aura and Lightning Web Components in particular, to take some sort of request and return the data for it, but only if/what the user can see. Per their secure ...
0
votes
1answer
27 views

Marketing Cloud Roles & Visibility, if allow and deny are not checked this means that it is not visible?

When setting up users in their respective roles, if the allow and deny boxes are not checked this means that the feature/capability is not visible to them correct?
0
votes
0answers
38 views

APEX PMD Security Error

Added Chrome PMD Extension Salesforce Advanced Code Searcher to run PMD script for my Apex Controller. Below Code doesn't shows any security error. if( Programs__c.SObjectType....
0
votes
0answers
77 views

PMD Apex ExcessiveClassLength & ExcessivePublicCount Rule error

Getting the following error message when I Ran the PMD scripts for Apex Class. ExcessiveClassLength -- Avoid really long classes. ExcessivePublicCount -- This class has a bunch of public methods and ...
0
votes
1answer
66 views

Default encryption for CloudPagesURL()

My client would like to know which encryption does CloudPagesURL() use to encrypt the parameters transferred to the Cloud pages. I am talking about the encryption used to transfer parameters to a ...
4
votes
2answers
282 views

PMD Apex ExcessiveParameterList Rule error

When I run the APEX PMD, getting Design Error for the Below method. ExcessiveParameterList Avoid long parameter lists. Checked below link not able to solve this issue, Can anyone please help me on ...
0
votes
0answers
16 views

What is the best sharing model for Category sharing of data

For My Application, I have to build a Category wise sharing, which means all data, objects related to Category A should be shared to a group of users and Category B should be not. So i have different ...
-1
votes
1answer
186 views

Apex Security rule Check of Soql/ DML [closed]

Trying to add Security Check on SOQL/ DML action in my Apex class. Gone through the following link https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/...
0
votes
0answers
62 views

How can I access a High Assurance Session in an Async Apex context?

Has anyone worked with a high assurance session requirement and async apex? I need to query the Security Health Check objects during an async process (the query happens in a queueable). If "View ...
0
votes
1answer
43 views

PMD Security - Apex Suggest Using Named Cred

Getting Suggest named credentials for authentication error in my PMD script. http http = new http(); httpRequest request = new httpRequest(); request.setMethod('POST'); request....
0
votes
1answer
16 views

Can we apply user-level security on the Javascript controller file and the helper file of a lightning component?

I have a lightning component with its associated javascript controller and helper. Now I have the requirement to make the javascript controller and the helper read-only. Can anyone give me an idea to ...
0
votes
0answers
30 views

Auditing on Report Access

There is a requirement to keep track on access provided to report(or folders). Also need to have a list of users who has access to which report(or folder). There is no direct way to get the list of ...
1
vote
1answer
81 views

Welcome Email not getting sent to community users on register

I have run into an issue where if I am unchecking a checkbox: 'Let guest users see other members of this community' under general setting in Preferences. If the check box is checked, welcome emails ...
0
votes
0answers
25 views

Salesforce mobile app - canvas app - pop up not working

I have a canvas app enable in a connected app. This canvas app is included in a visualforce page. The canvas app points to a web app hosted elsewhere. The web app authenticates its users by opening up ...
0
votes
2answers
107 views

PMD Security error - Apex Suggest Using Named Cred

I'm getting ApexSuggestUsingNamedCred **Suggest named credentials for authentication** in Below Code. Blob headerValue = Blob.valueOf(username + ':' + password); String authorizationHeader = '...
0
votes
0answers
83 views

stripinaccessible stripping fields for system administrator

I have a generic function to validate CRUD before DML which uses stripInaccessible(). public static SObjectAccessDecision validateCRUD(AccessType access, List<SObject> records, Boolean ...
3
votes
2answers
112 views

Tightening security around Javascript Remoting from Visualforce

We have a community portal built off of Visualforce pages and on those pages we do a lot of Javascript Remoting. Due to the complexity of our org, most of the Apex classes holding these remote methods ...
2
votes
1answer
65 views

Using isSet() vs getRemovedFields() to identify inaccessible fields after stripInaccessible()

I am wondering is there a difference between isSet() and getRemovedFields() to identify inaccessible fields that were removed by the stripInaccessible() method. From the official documentation Enforce ...
0
votes
0answers
19 views

Help with records not displaying on Force.com site

I've been building a Salesforce Site but am having trouble getting records to display on the page. I am using a specific Visualforce page as the homepage and can get the records to display fine when I ...

1
2 3 4 5
16