11

I wasn't satisfied with the accepted answer, specifically relating to the VisualForce aspect of it, so I performed some additional testing on this critical fix with regard to VF. What I learned is that when a VF iterator (apex:pageBlockTable, apex:repeat, etc.) is used against a Map, one of its undescribed actions is to sort the keys. This completely ...


11

Support for document.cookie being writable (scoped to your own namespace, similar to how localStorage and sessionStorage work in Locker) is at the top of our queue and (Safe Harbor :p) is planned to be released before the auto-activation date to give you time to verify functionality. I'll update this answer as progress is made. Edit (Feb 13, 2017): Read/...


10

There's been a family of long-standing issues with edge cases in how the platform handles caching schema describe information under the covers. As Daniel mentioned, there are KIs that have gone unfixed where issues like initializing the describe for say, Account, at an old API version and then trying to access it with a newer one would (incorrectly) omit ...


7

I'd checked in with Chris Peterson about this, specifically around the concern that I wouldn't be able to use Id.getSObjectType(). This critical update isn't about that altering that behavior. Instead it is to fix known issues like Missing dependent object: Field: .LastViewedDate error occurs when Apex class with API version 28.0+ is used in VF with API ...


7

Support for read/write has been added to Locker Service by Salesforce (thanks to @TrevorBliss for following up on that). However, the implementation does not work the same way as before Locker Service if your community uses a mix of Lightning and Visualforce. For example, if you have some pages that serve Visualforce PDF files, these pages will not have ...


6

My suggestion: just turn it on and test it on a sandbox or developer org. Should become pretty clear. Update: reading MarkPonds comment on behavior in VF, I would recommend to stick with the current pattern sfdcfox describes using sorted lists from keysets as iterators. The weird and incomplete documentation might be a hint that this isn't shipped as a big ...


6

It looks like Salesforce is currently doing 302 redirects for static resources requested from the salesforce.com domain when the security update is enabled. I didn't notice the redirect behavior until this morning, and was reasonably confident that we were getting 404's before. Turning the security update back off results in HTTP 200 instead of the 302 ...


5

This is anticipated behavior - from the release note This change affects Visualforce pages and Lightning components that directly reference custom metadata types. You can see a related known issue for a visualforce scenario where the recommended workaround is indeed to use a wrapper class. I'm on the team that builds custom metadata, I will work with ...


5

Steven Lawrence from Salesforce answered me on November 14 about this, at the Salesforce Success Community Group about Salesforce Infrastructure. His answer was: Fortunately, this change does not affect calls to PageReference.getContentAsPDF() or PageReference.getContent() when the PageReference object is for another resource within the org, such as ...


4

It is clearly stated in Salesforce disabling TLS 1.0. Note this option is completely unavailable for sandbox environments: June 25, 2016, at 9:30 AM PDT (16:30 UTC) After this date and time, all sandbox orgs -- whether existing, refreshed, or new -- will have TLS 1.0 automatically disabled and will require TLS 1.1 or later in HTTPS connections to or ...


3

When the critical update mentions query parameters it's referring the the values in the URL after the ?, so BillingCity=, Sales_Rep__c=, etc. The terminology is a bit inconsistent, see this question for an extended discussion on the matter. So if anything the bug in this case is that it's not stripping all your url parameters. My guess is that this is ...


3

There was a critical update on October 5th, 2018 to address a security vulnerability related to unauthenticated guest users. This critical update proactively limited the default permissions given to unauthenticated guest users, so if you have functionality in a Salesforce Site or Community that relied on the previously broader permissions, you will be ...


3

It depends on the integrations. 3DES is only one of several cipher suites that are used. During the TLS handshake, the client and server choose the most secure cipher that they have in common and use that. If 3DES is the only supported cipher, then connections will fail. Otherwise, there won't be any effect, as the connection will simply choose another ...


3

The real answer was provided by Matt Bingham over on Salesforce Success Get the ProfileId of Automated Process User using Dev Console SELECT ProfileId from User WHERE alias = 'autoproc' Coerce the URL that edits Apex class access for a Profile /_ui/system/user/ProfileApexClassPermissionEdit/e?profile_id=theAutomatedProcessProfileId and you'll get the ...


3

You're allowed a single queueable call per database execute method, so this code should technically work: // Must use Database.AllowsCallouts for PDF generation public with sharing class GenerateOnePDF implements Queueable, Database.AllowsCallouts { public void execute(QueueableContext context) { Blob v = Page.myPDFPage.getContentAsPDF(); ...


3

Different servers run different versions of salesforce at any given time. It's rare to see all servers on the exact same version, even mid-release. The auto activation date is, as far as I can tell, based in the scheduled release for a patch or release. Sometimes, like all things software, something fails QA, or a patch has to roll back because it broke a ...


3

Locker does introduce a small amount of overhead (reduced massively in the Winter'17 .11 patch) but it should typically not be significant. If you enable Lightning Components debug mode in Setup and grab a new set of profiles we'll get a much better set of symbols than the obfuscated h and l. @Sachin I originally added this as comment on your post and did ...


3

As far as I know (though looking over the Winter '18 release notes, which mentions that this critical update will be enabled for everyone as part of that release), the critical update you mention is only to allow you to set up CSRF protection on GET requests on a page-by-page basis (It shouldn't automatically turn that on for any existing page). That option ...


2

The first option for resolution is far preferable: The issue occurs with standard headers. If your Visualforce page does not require headers then you can set the showHeader attribute to false which should resolve the issue: <apex:page standardController="SObject" showHeader="false"> In API Version 38, the above attribute no longer fixes the error,...


2

I have faced the exact same issue when I try to connect to the salesforce org from Eclipse Kepler , And I changed the eclipse from Eclipse Kepler to Eclipse Mars and This error was eliminated. However at what point you got this error, If you were getting it in the Eclipse then try the option I have shared.


2

I went ahead and put together some tests and validated that Sets and Maps now do maintain their order like a List after the critical update is applied. Here is a unit test I put together that compares the order of a set and map to the order of a list. When I ran it without the critical update applied, it failed. When I ran it with the critical update ...


2

With Winter`16 release it would be resolved. Partners says: In the Winter '16 release, getContent() and getContentAsPDF() can be invoked from within Asynchronous Apex such as Batch Apex, Schedulable and Queueable classes, and @future methods. This provides an alternate solution for any partners impacted by the upcoming Critical Update and allows ...


2

After a call to SFDC Support, the answer seems to be: "Call SFDC Support to enable Automated Process user access to invocable classes before enabling this Critical Update." Clearly unsatisfactory. Let's hope Winter 20 has a solution. UPDATE: If you do call Support, they will tell you that you can self-serve by entering the Automated Process's ProfileId ...


1

After further testing, it turns out that the optionalFields property is more restrictive in the update. If an optional field is listed when not looking at the correct record type, it will prevent the wired method from running again when the recordId is updated. In our case, we use the component in both the Case page and Contact page. We had one wire/...


1

Not sure what is causing the confusion. Release notes states this update is to fix the bug introduced with Lightning components in managed packages: Prior to this update, non-global methods (that is, Apex controller methods that weren’t marked with the global access modifier) could be accessed by Lightning components outside of the package namespace.


1

How to access Opportunity2.Probability object? Is it a typo? No, they're variable names. It doesn't help that they named the first variable Opportunity, which is likely the source of your confusion. They're talking about a flow with two variables. I created a record from 'execute anonymous window' with percentage field set as 40 and I see it as 40 in ...


1

Based on sfdcfox's idea and code, I've just tried this and it works: public class FireEventsBatchable implements Database.Batchable<Integer>, Database.AllowsCallouts, Database.Stateful { // Entry point public static void execute(String requestId) { if (requestId != null) { Database.executeBatch(new ...


Only top voted, non community-wiki answers of a minimum length are eligible