Questions tagged [security]

Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

Filter by
Sorted by
Tagged with
64
votes
8answers
62k views

What is the best way to deploy profiles in Salesforce? (especially system admin)

What is the best way to deploy profiles in Salesforce? I have a system admin profile with access given to the objects that i have created in my sandbox. I have about 1000 fields across these objects. ...
83
votes
7answers
14k views

Apex static code analysis

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue ...
10
votes
3answers
16k views

What are permissions are needed to upload a file via a public Salesforce community page?

I would like to be able to upload files using <lightning:fileUpload which is on a public community page. The community is using template: Customer Account Portal. The files would get attached to ...
6
votes
1answer
4k views

Securely Storing a static API secret/key in a Salesforce app

I recently submitted an application to the AppExchange, only to have it not pass the security check due to "Insecure Storage of Sensitive Data Vulnerability." The problem is that my app accesses an ...
24
votes
5answers
14k views

Can web-to-lead be protected from spammers without additional server side processing?

The default web-to-lead functionality that Salesforce provides makes it really easy to drop an HTML form onto any web page and submit leads straight into a Salesforce Org. E.g. <form action="...
9
votes
1answer
9k views

Basic Http Authentication

I am writing a web service for which sends a SOAP payload as its body. In order to access the 3rd party server, I need an authenticated user. I am using Basic Http authentication for that purpose. ...
4
votes
1answer
4k views

Securing Sensitive Information with Salesforce Best Practices

I am working on an org in unlimited edition. Most of the 20 schools we are creating online applications for have separate banks. I am new to Salesforce and wondering what the best practice is for ...
33
votes
2answers
18k views

How to access profile permissions via API

If I know the name of a certain profile, I would like to obtain CRUD permission settings for each object in the profile using Apex. I see that there is an sObject called Profile, but this only ...
17
votes
2answers
6k views

are Triggers (and their delegated classes) or Batch affected by sharing?

I understand with sharing classes run in User Mode, meaning they respect permissions, field-level security and sharing rules of the current user. I understand without sharing classes run in System ...
27
votes
2answers
20k views

security token vs session id vs access token

Are all of these three separate values that are only linked for the same user ? For security token I mean on value that you can take from Setup -> My Personal Information -> Reset security token. As ...
45
votes
4answers
29k views

Can I get my security token without having to reset it?

I need to get a user's security token but there are other things currently using it so I don't really want to reset it. Is there any way to retrieve this without having to reset it?
9
votes
1answer
14k views

Why do I get 'PKIX path building failed' exception with my callout?

Error message :PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Hello all please see the above ...
5
votes
3answers
12k views

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

Does the Modify All Data or View All Data permission allow a user/profile to ignore the FLS settings for an object? The documentation would seem to suggest that this is the case, but I've found ...
2
votes
1answer
2k views

Root cause for "Entity is not org-accessible" for sharing object?

Not able to find Sharing object for custom object Apttus_Proposal__Proposal__Share; giving me error while List<Apttus__APTS_Agreement__share> st = new List<Apttus__APTS_Agreement__c>();
17
votes
4answers
10k views

Giving users access to a specific custom setting without granting them Customize Application access

I'm working on a VF page to give some users access to certain custom settings without given them the entire Customize Application access. Is there anyway to edit and commit data into the system as an ...
10
votes
1answer
25k views

How to use the escapeSingleQuotes method?

I'm trying to use this method in a dynamic SOQL query. Follow the sample code: public static String getRowById(String sobjName, id id) { String query = 'SELECT '; Map<String, ...
9
votes
4answers
18k views

What overrides a profile?

I am confused about the hierarchy of settings 1) I have a profile A and it has a read only access. I have a permission set specific to an user and the permission set grants the user access to edit ...
4
votes
3answers
5k views

Named Credentials - Merge Fields not Resolving

I am having an issue when attempting to reference the {!$Credential.UserName} and {!$Credential.Password} merge fields. I created a named credential with the following configuration: Identity Type:...
10
votes
2answers
3k views

Javascript Remoting CSRF

A third party security review is suggesting I need to add CSRF prevention to my javascript remoting calls. I'm not sure what is the best way to proceed. Switching to an apex:form to utilize built in ...
2
votes
3answers
8k views

Can we deploy PROFILES alone from one sandbox to another?

Can we deploy only profiles from one sandbox to another? Thanks
14
votes
3answers
6k views

How do I find out if a user has access to a visualforce page through apex?

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown. Sometimes the logged in user will ...
12
votes
2answers
3k views

Newbie Q: Is "Field Level Security" the same as "Field Accessibility"?

There are two buttons that seem very similar when viewing the detial page for an object: Set Field Level Security and View Field Accessibility. They both seem to allow you to set the field level ...
10
votes
2answers
4k views

How to set public inline images in Knowledge Base Article

Background I'm developing an standard FAQ using Knowledge Base Articles. I've defined an Article Type FAQ which contains a Rich Text field called "Answer". The FAQ articles are exposed to an ...
3
votes
2answers
3k views

Cryptoclass Throws Error. Invalid private key. Must be 16 bytes. Sending 16 characters long key

key__c :- abcdefghijklmnop public static String decrypt(String data) { EncryptionSettings__c settings = EncryptionSettings__c.getOrgDefaults(); if (settings.key__c == null) { throw ...
2
votes
1answer
414 views

Field History Tracking - control access to history?

re: the Field History Tracking feature, which you can turn on for specific objects and then specific fields within those objects: Is there any way to control access to the Field History? Apart from ...
5
votes
1answer
944 views

Edit Insufficient Privileges Page

Is there any way to gain access to the standard "Insufficient Privileges" page that everyone knows and loves(hates), in order to edit/replace it with something else? I imagine something along the ...
3
votes
1answer
3k views

invalid security token

Hi we were given an ExactTarget php application to port from an older Magento installation to a new Magento installation. This code is based on the ExactTargetSoapClient, soap-wsse.php and xmlseclibs....
2
votes
1answer
268 views

Want to prevent a user to access other user cases

I Want to prevernt user to access other user cases in search and report as well in salesforce, when user at same level in role hierarchy. My Organization-Wide Defaults setting is following Case: ...
1
vote
2answers
3k views

Hide a Field From ONE User

Scenario: If I had a Custom Profile / Standard Profile, say Sales,and I have 50 Users assigned to the same Profile and had same Permission / Access on a particular object (Could be Standard or Custom ...
27
votes
9answers
15k views

Can I compare Profiles?

We have many profiles in our org, and I suspect that some of them are redundant because the person who originally set them up didn't seem to understand the purpose of Profiles (confusion with Roles, ...
12
votes
2answers
8k views

Deploying Profiles / Permission Sets that include object & field permissions for Managed Objects

Anyone know if it's possible to deploy profiles/permission sets via Eclipse or an Unmanaged Package that contain object & field permissions for 3rd party managed objects? I'm trying to deploy a ...
21
votes
1answer
8k views

Use a Named Credential with API key?

I want to be able to make callouts to JotForm, but they do not support OAuth and username/password is insufficient for their API. Here are their docs; for reference, here are the 3 auth options: ...
10
votes
2answers
2k views

Is encrypting passwords in protected custom settings a security requirement?

Regarding the Salesforce security review process, can anyone confirm (or deny) that storing a connection URL, username and password for a webservice utilized by an appexchange app can be done in plain ...
8
votes
1answer
2k views

Critical Update "Serve Static Resources from the Visualforce Domain" still serves resources via Salesforce Domain

After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that ...
18
votes
1answer
2k views

What is the impact of the Release Update: "Enable Secure Static Resources for Lightning Components"? (due 2020-11-29)

On the Release Update page in the setup (/lightning/setup/ReleaseUpdates/home) I found this Enable Secure Static Resources for Lightning Components COMPLETE STEPS BY: 29.11.2020 TEST RUN SUPPORTED To ...
10
votes
2answers
2k views

Deploying From Sandbox (Enterprise) - loss of permissions, field security, etc

I have been reading up on this particular area of concern and from what I'm reading, it sounds like the solution I've been creating for the past two weeks is going to be a nuisance to deploy from ...
9
votes
1answer
284 views

PIN Security for a Force.com Mobile SDK App

There's a feature for PIN protection which works with Mobile SDK applications which provides an extra level of security for users. The PIN configuration is done as part of a connected app as shown ...
5
votes
1answer
214 views

Determine org. wide security on an object

I'm trying to determine (in APEX) what the security level is of a custom sObject (for a UI) For example: mysObject__c (Public Read Only, Private, etc.) I know it's possible to test the by inserting ...
4
votes
1answer
524 views

Can FeatureManagement.changeProtection() be used to Protect any Custom Object?

Winter 18 introduced the FeatureManagement Apex Class, which contained a method which I was not expecting: changeProtection. According to the docs, changeProtection can be used to "Unprotect" objects ...
3
votes
1answer
101 views

Security Review: Lightning: CSS Outside Component

In our SF Security Re-Review report a lightning component was flagged for "Lightning: CSS Outside Component". The lines they referenced were: ... <button style="font-size: 20px;top: ...
2
votes
1answer
4k views

Refused to display 'https://www.salesforce.com/de/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

I created VF page (or also to see the VF page inside a lightning component). I added an apex iframe with src="https://www.salesforce.com/de/" (or any other source) from salesforce apex iframe guide....
1
vote
1answer
569 views

Related to Digital signiature

Something related to Digital signature if we have a doc in sales-force and needs to be digitally signed, which involves digital certificates.. and how we can use crypto class of apex in this. also ...
21
votes
5answers
3k views

Is it possible to have different password policies for different users?

Can I have a certain profile to have a password change policy of 1 year, and other profiles (or the rest) as change every 60 days? I know you can set it for the entire organization, I need to specify ...
15
votes
4answers
2k views

Twilio Integration and SSLv3 POODLE Vulnerability

I have an existing integration with Twilio that works great - Twilio posts a message to a custom SFDC REST endpoint, and we can generate a new SMS message by calling out to the standard Twilio REST ...
8
votes
1answer
899 views

Most optimal way to Enforce CRUD/FLS in Apex

This article shows a common way to check access in Apex with a syntax like: if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } However, it is very time/space-consuming to ...
6
votes
3answers
17k views

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY: insufficient access rights on cross-reference id: []

I have a custom object Resource__c having master detail with Account object. I have Account1 created by User1 and if User2 goes to create resource on Account1 then below error is given :"...
6
votes
1answer
5k views

Why are there 3 functions to encode in Visualforce?

I'm following the Injection Vulnerability Prevention module on Salesforce Trailhead, and I'm reading about the Visualforce functions to encode data to prevent XSS attacks. To quote from the module: ...
5
votes
2answers
8k views

X-Frame option set to deny in I-Frame inside salesforce

I am struggling with a error when i am trying to display a page of external application in an i-frame using tag due to an error X-frame Options Set to Deny .I have attached the screenshot of issue i ...
4
votes
1answer
4k views

system.security.NoAccessException: Update access denied for RecordType

I have a Visualforce Page that uses a standard controller (Opportunity) and an extension. In the extension I have a method that saves updates to the opportunity and a related contact. The extension is ...
3
votes
1answer
2k views

list of permissions included in a permission set?

I want to see which permissions are included in one of my permission sets. is there a way to get them all at once? Best I can see is that you have to go through 5- 6 different screens