Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
1
vote
3answers
432 views

How to enable Verification Code emails for Customer Community users?

When you log in to Salesforce for the first time from a new computer (or new browser), you are asked to provide a Verification Code which is emailed (or texted) to you, as an additional security ...
0
votes
0answers
21 views

VisualForce Page - Detail Page Button - not displaying

I have a Detail Page Button on opportunity that open Visualforce page. From this Visual force page I can navigate through multiple Visualforce pages.That was working very well and without any changes ...
0
votes
0answers
28 views

Apex BeAwesome failed [closed]

I keep failing this test and I don't know how to fix the issue. Mostly because I'm not sure how to identify the specific lines mentioned: Class.sb_security.BeAwesome.createUser: line 133, column 1 ...
3
votes
0answers
45 views

Standard User with “Modify Metadata” fails to create active Picklist Value

What is failing here perfectly works for a SysAdmin user. I have a StandardUser with a permission set which grants him ModifyMetadata and calling this code creates the Picklist Value but leaves it ...
1
vote
1answer
39 views

Do you need Read access to an object to view its records in a report?

I believe if you have access to a report, record level access can be ignored and you can potentially see all records. Does this apply at the object level of a profile? So say a report is on Accounts, ...
0
votes
1answer
393 views

Refused to display 'https://www.salesforce.com/de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

I created VF page (or also to see the VF page inside a lightning component). I added an apex iframe with src="https://www.salesforce.com/de/" (or any other source) from salesforce apex iframe guide....
0
votes
0answers
17 views

How exactly are the Einstein analystics external connectors secured?

I'm trying to connect einstein analytics to one of our local data servers. But network wont add the whitelist until they know how does this connection stay secure? And luckily for me not a single ...
0
votes
0answers
24 views

Can Code triggered by Chatter-Free user run in System mode?

I am exposing some code to Chatter Free user which modifies Account objects. I know that Chatter Free users are not directly able to modify them. But can my trigger code do it on behalf of them? As ...
0
votes
0answers
57 views

View report records by queues not working

I have a custom report (Sales Orders with Work orders) but it doesn't filter out by queues. Both objects are on PRIVATE in the OWD and I have set the filter to the one in the print screen Any user ...
0
votes
2answers
543 views

Private opportunity visible to everyone

Made an opportunity private in salesforce. But it's still visible to users with same role. How to find out why? I used the default isprivate flag for this. It should make the opportunity visible to ...
-3
votes
1answer
41 views

Ability to the employee user to edit the records created by manager

I have 2 roles (Manager and Employee). Employee reports to Manager. Employees should be able to edit Case records created by manager. OWD on the Case object is Private. Created a criteria based ...
1
vote
1answer
22 views

Default Sandbox access situation with regards to users

So when a Sandbox is refreshed or created, everyone's email gets changed so that it has .invalid on the end. This seems to have the useful side effect of stopping users from logging in - when they ...
0
votes
0answers
31 views

How can I prevent unauthenticated users from downloading an attachment?

I have a community and internal links to attachments. They end with ...servlet/servlet.FileDownload?file={ID} When the user clicks the link, a window.open(fileUrl) is called. This prompts to download....
2
votes
1answer
367 views

Solution to Tokenized Sending limitations in Salesforce Marketing Cloud(SFMC)

So our Prospect want to implement Tokenized Sending Features because they don't want to store data in SFMC before sending Email/SMS and want to use REST API to push data into SFMC but again they want ...
15
votes
2answers
4k views

are Triggers (and their delegated classes) or Batch affected by sharing?

I understand with sharing classes run in User Mode, meaning they respect permissions, field-level security and sharing rules of the current user. I understand without sharing classes run in System ...
0
votes
0answers
17 views

How to hide records from Community users based on record type

I have requirement wherein i need to hide/show records from Community users based on record type i.e., Community Users should only see records of X object but only for the type of record type assigned ...
4
votes
1answer
462 views

Cookie with HttpOnly flag

I work on Demandware platform, and use dw.web.Cookie class. there is no way to add HttpOnly attribute to the new Cookie. Do we have any solution or workaround?
0
votes
2answers
224 views

Checkmarx Scanner is usless for CRUD and FLS issues checking?

Checkmarx report field Id (User Object) as FLS Create violation whenever the code checks for OwnerId (Account Object) field is createable. Is it false-positive result or can I enforce FLS somehow to ...
2
votes
1answer
500 views

Adding members to Account Team

OWD for Account /Opportunity and cases are private. I have formed a group in the organisation which includes only post sales consultant. The members of the group should have the flexibility to add ...
3
votes
1answer
36 views

Is Jest mandatory in LWC For appExchange app

As SF stated Jest is independent of Salesforce and doesn't run in web browser. Is it mandatory to write coverage/unit testing for Lightning Web Components and add in bundle while creating manage ...
11
votes
2answers
462 views

Why can't my SFDC Staffing Coordinator add a shared resource to an Assignment?

Currently working my way through Addison Wesley's Development with the Force.com Platform; having a problem on page 90. I've created all the requisite sObjects and profiles, as described in the book. ...
0
votes
1answer
41 views

with sharing without sharing vs extension?

While going through manuals, it was mentioned Many times that apex classes will not consider security of logged in user but it will run in system mode and we should add custom controller extension to ...
7
votes
1answer
2k views

SOQL: prevent SOQL injection - best practices

I have a query string that is as follows(no bulkification required)... String qryString = 'SELECT Id FROM Contact WHERE (IsDeleted = false and Name like \'%' + searchText+ '%\')'; searchText is a ...
0
votes
0answers
15 views

Security - See which user exported reports [duplicate]

Is there a way which I can know which user made export to report? Details about the user, date and time and the report name? (A free tool will be great). Thanks!
73
votes
7answers
12k views

Apex static code analysis

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue ...
0
votes
1answer
580 views

Using without sharing with customer community - can't create account

It looks like customer community users can't create Account records because there is no create option in object settings for a customer community profile. I thought that I could get around this if ...
0
votes
0answers
13 views

How to secure API end points in custom activities?

I have a custom activity created for the journey builder. From a security point of view, how can I protect my REST endpoints? I know we can get the fuel token in the getToken method from postmonger. ...
5
votes
1answer
642 views

Why do force.com sites domains have secure in the domain and some don't?

In our production org, force.com sites have two endpoints listed https://<ourdomain>.secure.force.com http://<ourdomain>.force.com It seems that these URLs can be used interchangeably ...
1
vote
0answers
11 views

Using Protected Component for “Secret Protection” with Unlocked Packages

How do "Protected Components" (Custom Settings or Custom Metadata) function when installed from an Unlocked Package. I was hoping that I would be able to use as "Protected (Managed)" to store "...
1
vote
1answer
634 views

Use Strict Transport Security (HSTS) with Salesforce

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a ...
0
votes
0answers
25 views

Need help on Salesforce Login discovery

Requirement-I want one of the dedicated profile to be redirected to seprate SSO flow and others needs to redirect to normal username/password flow. I have gone through Login discovery but it seems to ...
1
vote
2answers
56 views

How to temporarily Disable Access for Entire Org?

How to temporarily Disable Access for Entire Org? For all Internal and/or All External users.
1
vote
2answers
28 views

Remove password policies from profiles and have only one central password policy?

In our org, some profiles have their own password policy; these overwrite the general password policy. I would like to return to having only one centralized policy. How can I do that? I cannot find a ...
3
votes
1answer
140 views

Can FeatureManagement.changeProtection() be used to Protect any Custom Object?

Winter 18 introduced the FeatureManagement Apex Class, which contained a method which I was not expecting: changeProtection. According to the docs, changeProtection can be used to "Unprotect" objects ...
0
votes
1answer
88 views

Update failed. INSUFFICIENT_ACCESS_OR_READONLY, You do not have the level of access necessary to perform the operation you requested

Background I have created a custom upload component based on this but using ContentVersion rather than Attachment. This custom upload component is being used on a public community page and has an ...
1
vote
0answers
76 views

CPQ - twin fields not working for certain profiles due to security setting

We are building a twin field in quote and order in the hope that the field value can be automatically copied into order. This is working for other profiles but not sales user since they don't have ...
1
vote
1answer
51 views

Sharing of a junction object

What access would a junction object have if one master object has read-write access while the other master object has read access through the sharing rules with organization-wide defaults private for ...
4
votes
2answers
4k views

What could be the situation - Record Currently Unavailable- Record Lock Issue

One of user from my org got this error while changing an owner of Account. (there is a trigger on Account who updates its child opportunities too ) Now I am unable regenerate the error. So my ...
2
votes
1answer
43 views

How do guest communities allow access to detail pages?

Do communities evaluate the Record requested when determining if a page should be accessible? So we have a guest community, which we share some accounts to, for varying purposes. For some childA and ...
0
votes
1answer
32 views

Able To Delete Sobject Even if No permission for User

I have an Invoice Object inovice1, A profile sales1.Profile sales1 have no crud permission for invoice1 object not even read. Also OWD for Invoice object is set to private.Still I am able to insert,...
0
votes
1answer
58 views

Getting error while adding a trusted site

I am adding some markup in "Head Markup" section of Community Builder(Settings --> Advanced) that references resources from 3rd party websites. Thus, SFDC gives me CSP violation warning in the markup. ...
4
votes
1answer
70 views

Security Question AuraEnabled Dynamic SOQL

Let's say I have an Apex Class like this: public with sharing class AuraUtils { @AuraEnabled(cacheable=true) public static List<SObject> databaseQuery(String queryString){ List<SObject&...
1
vote
1answer
137 views

Showing HTML contents in Managed Lightning Component

We have developed a Managed Grid component where users can dynamically pass column definition and data which will be rendered as SLDS table. We support datatypes such as Text,Date,DateTime.. so on. ...
0
votes
1answer
81 views

JWT Bearer flow vs. Username+Password flow in server-to-server integration

Official documentation and some SFSE answers advise against the use of Username + Password flow (Resource Owner Password Credentials Grant in oauth). The JWT Bearer flow is also recommended as a ...
1
vote
1answer
489 views

How to make pdf rendering non-editable or password protected

I am trying to check the best possible secure solution. Is it possible to make pdf rendering non-editable or password protected
4
votes
3answers
2k views

Can I Mass Modify Object Settings > Tab Settings for All Profiles? (Default On/Default Off/Hidden)

I am in the process of my first Salesforce deployment to Production (my company has been working with an implementation team for 7 months or so, and we are going live on Monday). We had some security ...
0
votes
0answers
30 views

Can we give user permission to add Notes & Attachments even user's profile has Read only for that object

I have a below setting for the object. ORG wide defaults- Private User's Profile - Read, View All Can I have user to add notes and attachments despite the fact he can't edit object. Thanks
1
vote
2answers
1k views

Restricting record level access in role hierarchy

If i set the OWD for Account as private and if i create a public group and add some users into that and create a sharing rule for giving read and write access to that public group then managers of the ...
1
vote
0answers
16 views

How do I test the security of the Salesforce site? [duplicate]

What is the best practice to test security? In my case, I have a site with a database. Salesforce provides good data security of its users. So, in my Org, I have records (contacts, contact ...
4
votes
0answers
21 views

Calling the UI Api from a community with a custom domain name - getting sun.validator exception [duplicate]

Context: we're using the UI api to get some Record Type dependent picklist values back. This is happening in a community context. In the lower environments (dev, QA) this works without issue. The ...