2022 Developer Survey is open! Take survey.
22 votes
Accepted

Does Process Builder run with System permissions or User permissions?

According to this answer: Process Builder runs in the system mode so the object and field level permissions both will be ignored for the user who triggers the Process.
user avatar
17 votes
Accepted

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

Modify All Data and View All Data do not, in any way, affect Field Level Security. The only permission that affects Field Level Security is Edit Read Only Fields. Apex Code generally ignores Field ...
user avatar
  • 430k
15 votes

Set Field Level security for profile using meta-data api

It does not have to be through the retrieve->deploy process. I got this to work using CRUD metadata api calls. This is the meat of the logic in C# Logger.Info("SalesForceProxy....
user avatar
13 votes
Accepted

Make a button on a layout be visible only to a specific group of users

Buttons don't have a corresponding "button-level" security. There are at least three ways to get around this: Write a Visualforce page that overrides your default layout. Have that Visualforce page ...
user avatar
  • 430k
13 votes
Accepted

Newbie Q: Is "Field Level Security" the same as "Field Accessibility"?

You can modify Field Level Security from the Field Accessibility screen, but it's not the only thing you can modify. From Modifying Field Access Settings: From the field accessibility grid, you ...
user avatar
  • 142k
11 votes

Make a button on a layout be visible only to a specific group of users

Sfdcfox answer looks fine to me, however I have some remarks to point 1. and it is quite an improvement so I decided to not leave it as a comment but as a seperate answer, because some people may find ...
user avatar
  • 694
8 votes
Accepted

Field-Level Security (FLS) in Lightning Components

Since Winter 20 release, we have Security.stripInaccessible() method which strips the fields that the current user can’t access from query and subquery results. Since Spring 20 release Security....
user avatar
8 votes
Accepted

Field Level Security for new fields

This is actually in the documentation: When you create a custom field, by default the field isn’t visible or editable for portal profiles, unless the field is universally required. So, the answer ...
user avatar
  • 430k
7 votes
Accepted

Workflows and field-level security

Workflows are not dependent on FLS. They will fire and update fields regardless of if the users causing the workflow to fire has access to that field. Essentially they run as a "system" context.
user avatar
  • 53.1k
7 votes
Accepted

How to opt out of FLS validation when a SOQL query is run by a trigger?

I am partial to stripInaccessible because WITH SECURITY ENFORCED because the queries throw an exception if any of the fields are not available to the user. I would not make it automatic to trigger ...
user avatar
7 votes
Accepted

What exception does Security.stripInaccessible throw?

It's a System.NoAccessException. The message is: No access to entity: MyObject__c Not sure the easiest way to verify, but I set up a Visualforce Page with the below controller so the running user ...
user avatar
  • 142k
6 votes
Accepted

Schema.SobjectField Access Changed in API v34.0 (Summer '15)

So, I was wrong about the Class/Method changes. I am not going to remove this question because I hope it will help someone else. It turns out if you're in a packaging org (like me) and have namespace ...
user avatar
6 votes
Accepted

How does Read-Only field level security affects Apex and Workflows

Apex and Workflows function independently of field level security; see the documentation for considerations for workflows and Field level security. So Apex code and workflows will be able to read and ...
user avatar
6 votes
Accepted

How to make custom object record only visible to certain users based on field checkbox

Set sharing on the entire object to Private. Add the two users to a Permission Set that has View/Modify All on the object. Add a criteria based sharing rule that shares records with Private = FALSE to ...
user avatar
  • 10.6k
6 votes
Accepted

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

To help others who end up here, my response as an answer: From what you posted, looks like a false positive - so I would document it in review. Here is a link to a recent update from the SR team ...
user avatar
6 votes
Accepted

Field level security pain in Apex tests when using packaging 2

You can specify permission sets to use for version creation. A snippet is provided in the documentation. "packageDirectories": [ { "path": "force-app", ...
user avatar
  • 430k
5 votes
Accepted

Basic unit test to check if I have read access to a field - Apex

From your question it looks like you want to check if a field is editable / createable by the current user. I think you can do this by using the DescribeFieldResult class. In the below example I have ...
user avatar
  • 4,313
5 votes

Process Builder user has write access to read only field

Your question has already been answered here. Process Builder runs in the system mode so the object and field level permissions both will be ignored for the user who triggers the Process.
user avatar
5 votes
Accepted

Non-Read-Only field giving error with trigger that it is read-only

This sounds like you're trying to modify a record contained in a trigger context variable (possibly in an After trigger). Taking a look at the documentation on trigger context variables, there is ...
user avatar
  • 46.8k
5 votes

Drawbacks of Marketing Cloud field level encryption?

there are quite a few limitations you need to be aware of with field level encryption. Some of the big ones are: Data Filters are not supported You cant use encrypted values in where clauses Standard ...
user avatar
  • 291
5 votes
Accepted

IsUpdateable returns true for Admin profile, even though I removed edit access

Administrators have the "Edit Read Only Fields" permission, so removing "Edit" from a field has no effect on fields administrators can view. They can still edit fields which could be edited as if they ...
user avatar
  • 430k
5 votes
Accepted

How to pass Schema.SObjectType to a class method as an argument?

The SObjectType.<ObjectName> syntax actually refers to a DescribeSObjectResult. So you'd have to either pass in a DescribeSObjectResult, or call the getDescribe method yourself: Map<String, ...
user avatar
  • 430k
5 votes

How to make custom object record only visible to certain users based on field checkbox

You can't do this with a simple permission set. You have to set the sharing model to private and use sharing rules to control the access. Modify All The Modify all permission can be applied in a ...
user avatar
  • 9,063
5 votes

Visible vs Read Only?

The hierarchy of permissions shown in this particular facet of the Salesforce UI is a bit backwards compared to the way we usually talk about permissions. Most of the time, when talking about CRUD/FLS ...
user avatar
  • 86.2k
5 votes
Accepted

Why is stripInaccessible removing an M-D field?

It may well be related to whether or not your relationship is reparentable. If not, the field would not be updateable.
user avatar
  • 142k
4 votes

How do 'Modify All Data' and 'View All Data' affect Field-Level Security settings

It's worth noting that apex does not enforce field level security, even if run with sharing. Typically visualforce handles enforcement of these for you by doing things like not rendering apex:...
user avatar
  • 22.1k
4 votes
Accepted

Set Field Level security for profile using meta-data api

Update Since this was posted there are now simpler ways to accomplish this. Refer to Greg's answer for specifics. Original Answer Yes, it's possible, but it's not particularly easy. Unlike ...
user avatar
4 votes
Accepted

Contact last-modified date changed by read-only user

In no particular order... Time-based workflows with one of these guys as "default running user"? batch jobs scheduled as one of these guys (Apex will run in system mode and unless the code ...
user avatar
  • 23.6k
4 votes
Accepted

Why did I fail Security Review when not checking FLS or using "without sharing"?

The perfect answer was recently given by MVP Dan Appleman in his article Without Sharing: Best practices when bypassing Apex sharing rules and object security. Application internal data, Business ...
user avatar
4 votes
Accepted

Manually enforcing FLS in my controller. Is there a way?

If your user can see the field in the UI, then that tells me the user still has access to the field. Visualforce obeys field level security and won't display fields the user doesn't have access to. ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible