Hot answers tagged

12 votes
Accepted

Most optimal way to Enforce CRUD/FLS in Apex

You could write a helper method for this type of functionality: public Object flsGet(SObject record, SObjectField field) { return !field.getDescribe().isAccessible() ? null : record.get(field); } ...
  • 144k
8 votes
Accepted

Do we allow CRUD & FLS in each component of Apex?

Generally, code you've written is already CRUD- and FLS-safe, as long as you follow the basic guidelines regarding Visualforce elements (e.g. check FLS when not using apex:inputField, etc). You can ...
  • 445k
8 votes

Security Review - CRUD/FLS Checks for every SOQL Query

You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. ...
7 votes
Accepted

How to test CRUD and FLS in unit tests?

There are a few different ways to attack this problem, but the most common is to create a user with permissions, and then use System.runAs to execute your tests. I normally grant permissions to my ...
6 votes
Accepted

How do I check CRUD and FLS in apex?

Please refer to this knowledge article. Basically you just need to add some checks like if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } or if (!Schema....
  • 13.9k
6 votes
Accepted

Integration with REST API that is not CRUD

In Salesforce, everything is a CRUD operation. As far as your service is concerned, it needs to support CRUD OData operations. Your application would need to be modified to support CRUD operations. ...
  • 445k
6 votes
Accepted

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

To help others who end up here, my response as an answer: From what you posted, looks like a false positive - so I would document it in review. Here is a link to a recent update from the SR team ...
5 votes

CRUD & FLS on Managed Package Objects

Yes the CRUD/FLS are also important on the packaged objects .The decision to assign the permission set or not should be left with the org administrator and not something the package vendor can ...
5 votes

isAccessible() vs isQueryable() and which one to use for SOQL query CRUD checks

You should use isAccessible() for read check. isCreateable() to check whether object record is creatable isUpdateable() to check whether a user can update record. isDeletable() to check whether a ...
  • 3,315
5 votes
Accepted

Dynamically enforce object and field level security?

You might try getting the DescribeSObjectResult directly from the global describe and checking against that: SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c'); Boolean ...
  • 144k
5 votes
Accepted

How to update a field with Lightning Components?

I think the error lies in these lines var action = component.get("c.account"); action.setParams({ "account": account }); try changing it to var action = component.get("c.saveAccount"); var account ...
  • 2,700
5 votes
Accepted

How to best enforce CRUD/FLS and pass Security Review

The best option today I think is to largely avoid CRUD & FLS and enforce security via custom permissions aligned with your business processes but that is not really answering your question. Part ...
5 votes

How to best enforce CRUD/FLS and pass Security Review

The answer was given by Chris Peterson (PM of Apex) and MVP Daniel Ballinger during Dreamforce '19 in the session "Reducing the Cost of Enforcing CRUD and FLS in the ESAPI". And the answer is: By ...
4 votes
Accepted

IP Address Restrictions Other Than Profile-Based?

You can't have assign IP restrictions through Permission sets (or) Workflows or any other ways. For your problem you have to assign a separate profile for the user is only the way.
  • 1,474
4 votes

How to best enforce CRUD/FLS and pass Security Review

The most voted advice will get you failed at the security review. End-users rely on CRUD/FLS configurable from UI Setup, and they will get quite surprised that your app does not respect the standard ...
  • 179
3 votes

AppExchange ISV Security Review CRUD/FLS Puzzler

FLS is not automatically enforced just because you used "with sharing." You must check for access to the field before you display it to the user. Typically, if you use apex:inputField or apex:...
  • 445k
3 votes

CRUD and FLS enforcement

So Yes its of course possible you can do it in two ways (which essentialy are the same) Schema.sObjectType.Account.isUpdateable() and Account.sObjectType.getDescribe().isUpdateable() if (!Schema....
  • 2,052
3 votes
Accepted

Will Sharing=ReadOnly allow my user to Delete or Clone a record

My understanding of ReadOnly is that they would be able to clone if they have IsCreateable permission, but not delete even if they had the CRUD access, because typically, only the owner or someone ...
3 votes
Accepted

How to enforce CRUD and FLS in bulk trigger?

Do not throw exceptions in a trigger. This can cause undesirable side effects. You should always use addError in a trigger, and never allow an exception to escape from a trigger. In recent releases, ...
  • 445k
3 votes

How to check other user's CRUD permission for an object (APEX)

You can try like below String desireUserId = UserInfo.getUserId(); // or pass any other user id. User u = [select profileId from user where id =: desireUserId]; String profileId = u.profileId; List&...
3 votes

soql on object permissions on a profile

according to Standard Field Record ID Prefix Decoder I found few words about X00 Id prefix: Found in the PermissionSet Name column where the ProfileId is also defined. It matches the ProfileId ...
3 votes

How to test CRUD and FLS in unit tests?

The approach we took was to provide a special class, e.g. SecurityUtils, with a bunch of static methods on it that take the DescribeSObjectResult(s) or DescribeFieldResult(s) to be checked, e.g.: // ...
  • 28.7k
3 votes

How to best enforce CRUD/FLS and pass Security Review

TBH, considering that new security features are on the way but not quite GA yet, maybe your best bet is just to write your own central helper classes that will handle CRUD/FLS to exactly the extent ...
  • 10.7k
3 votes
Accepted

CRUD/FLS checks on fields of a lookup

There are often situations where there's a one-off use case where a user persona needs access to data but they shouldn't have blanket access to those objects/fields via OLS/FLS. When reviewing the ...
2 votes

Security scanner: enforcing CRUD. Auto scanner reported issue

I believe if you think you have the CRUD check in place and you still get the alert, it is better to give a false positive document along with the report to Salesforce while doing a AppExchange ...
2 votes
Accepted

FLS Create for upsert

You need to check both isCreateable() and isUpdateable() for upsert.
  • 3,891
2 votes
Accepted

Enforcing CRUD / FLS / Sharing in Apex

With the help of Eric I am going to try to answer my question by myself: CRUD and FLS is part of metadata, so information about (custom) objects in general. With the Schema Class one should determine ...
  • 218
2 votes
Accepted

Creating metadata in client org

Hopefully you have good error handling in your code, and if you make a support request to Salesforce you can get detailed logging enabled for your managed package in the org it is installed into and ...
  • 131k
2 votes
Accepted

Allow my customers to edit their details via force site

The reason that you are running into an issue is because Authenticated Website users do not have access to the Contact object. Visualforce will not display anything on the page for bound sObject ...
  • 14.5k
2 votes

Manually Enforce CRUD and FLS in trigger handler and Ajax to pass salesforce security review

When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page. For example, if a ...
  • 8,990

Only top scored, non community-wiki answers of a minimum length are eligible