23
votes
Accepted
Does Process Builder run with System permissions or User permissions?
According to this answer:
Process Builder runs in the system mode so the object and field level
permissions both will be ignored for the user who triggers the
Process.
- 12.7k
14
votes
Accepted
For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?
We are recommending developers use WITH USER_MODE and avoid using the WITH SECURITY_ENFORCED
In fact, at some time in the future, we may likely retire WITH SECURITY_ENFORCED
The WITH USER_MODE ...
- 90.4k
13
votes
Accepted
Newbie Q: Is "Field Level Security" the same as "Field Accessibility"?
You can modify Field Level Security from the Field Accessibility screen, but it's not the only thing you can modify.
From Modifying Field Access Settings:
From the field accessibility grid, you ...
- 149k
8
votes
Accepted
Field-Level Security (FLS) in Lightning Components
Since Winter 20 release, we have Security.stripInaccessible() method which strips the fields that the current user can’t access from query and subquery results.
Since Spring 20 release Security....
- 7,454
8
votes
Accepted
Field Level Security for new fields
This is actually in the documentation:
When you create a custom field, by default the field isn’t visible or editable for portal profiles, unless the field is universally required.
So, the answer ...
- 481k
7
votes
Accepted
How to opt out of FLS validation when a SOQL query is run by a trigger?
I am partial to stripInaccessible because WITH SECURITY ENFORCED because the queries throw an exception if any of the fields are not available to the user. I would not make it automatic to trigger ...
- 13.1k
7
votes
Accepted
What exception does Security.stripInaccessible throw?
It's a System.NoAccessException. The message is:
No access to entity: MyObject__c
Not sure the easiest way to verify, but I set up a Visualforce Page with the below controller so the running user ...
- 149k
7
votes
Accepted
Field level security pain in Apex tests when using packaging 2
You can specify permission sets to use for version creation. A snippet is provided in the documentation.
"packageDirectories": [
{
"path": "force-app",
...
- 481k
7
votes
Accepted
WITH SECURITY_ENFORCED and Security.stripInaccessible in a single SOQL
You don't need both. If you use WITH SECURITY_ENFORCED, you'll get an exception thrown if any fields are not readable by the user, while with Security.stripInaccessible, you'll simply remove any ...
- 481k
6
votes
Accepted
Schema.SobjectField Access Changed in API v34.0 (Summer '15)
So, I was wrong about the Class/Method changes. I am not going to remove this question because I hope it will help someone else.
It turns out if you're in a packaging org (like me) and have namespace ...
- 16.2k
6
votes
Accepted
How does Read-Only field level security affects Apex and Workflows
Apex and Workflows function independently of field level security; see the documentation for considerations for workflows and Field level security.
So Apex code and workflows will be able to read and ...
- 4,378
6
votes
Accepted
IsUpdateable returns true for Admin profile, even though I removed edit access
Administrators have the "Edit Read Only Fields" permission, so removing "Edit" from a field has no effect on fields administrators can view. They can still edit fields which could be edited as if they ...
- 481k
6
votes
Accepted
How to make custom object record only visible to certain users based on field checkbox
Set sharing on the entire object to Private. Add the two users to a Permission Set that has View/Modify All on the object. Add a criteria based sharing rule that shares records with Private = FALSE to ...
- 10.9k
6
votes
Accepted
Apex Source Scanner flag CRUD/ FLS as security risk for no reason
To help others who end up here, my response as an answer:
From what you posted, looks like a false positive - so I would document it in review.
Here is a link to a recent update from the SR team ...
- 13.5k
6
votes
Accepted
Why is stripInaccessible removing an M-D field?
It may well be related to whether or not your relationship is reparentable. If not, the field would not be updateable.
- 149k
5
votes
Accepted
Non-Read-Only field giving error with trigger that it is read-only
This sounds like you're trying to modify a record contained in a trigger context variable (possibly in an After trigger).
Taking a look at the documentation on trigger context variables, there is ...
- 59.3k
5
votes
Process Builder user has write access to read only field
Your question has already been answered here.
Process Builder runs in the system mode so the object and field level
permissions both will be ignored for the user who triggers the
Process.
- 3,751
5
votes
Does Process Builder run with System permissions or User permissions?
Process Builder always runs in System context and hence you can edit the record or read the record even if user does not have access to the same .
- 90.4k
5
votes
Drawbacks of Marketing Cloud field level encryption?
there are quite a few limitations you need to be aware of with field level encryption.
Some of the big ones are:
Data Filters are not supported
You cant use encrypted values in where clauses
Standard ...
- 301
5
votes
Accepted
How to pass Schema.SObjectType to a class method as an argument?
The SObjectType.<ObjectName> syntax actually refers to a DescribeSObjectResult. So you'd have to either pass in a DescribeSObjectResult, or call the getDescribe method yourself:
Map<String, ...
- 481k
5
votes
How to make custom object record only visible to certain users based on field checkbox
You can't do this with a simple permission set. You have to set the sharing model to private and use sharing rules to control the access.
Modify All
The Modify all permission can be applied in a ...
- 9,441
5
votes
Visible vs Read Only?
The hierarchy of permissions shown in this particular facet of the Salesforce UI is a bit backwards compared to the way we usually talk about permissions. Most of the time, when talking about CRUD/FLS ...
- 92.1k
4
votes
Platform Encryption vs. FLS
Platform Encryption will go further than just preventing the users from seeing data, it will also encrypt the fields at the database level. For example, you can't even issue a SoQL query doing an "...
- 13.1k
4
votes
How do you configure Field Level Security for Custom settings in managed package?
There is no field-level security for custom settings: access to all custom settings and all the fields in those custom settings is controlled by the "Customize Application" permission.
You can give ...
- 135k
4
votes
Accepted
Attempt to de-reference a null object on when calling Schema.getGlobalDescribe().get(sObjName).getDescribe();
The error message just describes the situation where the object name you passed in wasn't found in the describe map and your code assumes it is always going to be found and is trying to call ...
- 22.9k
4
votes
Accepted
Visualforce Lookup field not allowing entry for certain profiles
The field accessibility will show access to the fields assuming they profile has access to the object.
Ensure the profile has edit or create access to the PriceBook object and at least read on the ...
- 54k
4
votes
what is the best practice to make a field as Read-only among Page layouts Vs Field level security
It is safer to make the field read-only via field-level security. This prevents that user from updating the field at all -- including Data Loader, Visualforce, anonymous Apex, etc. None of these would ...
- 183
4
votes
Accepted
Add Field level security for person accounts field
Name is a compound field on these two objects. Which is a combination of FirstName, Lastname, Salutation. You can't set security for individual field. You need to setup this for Name field.
BTW Name ...
- 29.4k
4
votes
Can we change FLS for required field?
You can only change the FLS for required fields if they are required only by the page layout. In this case you can remove the field from the layout, and it won't be required anymore.
If the ...
- 12.7k
4
votes
Accepted
Enforce Field-Level Security Permissions for SOQL Queries WITH SECURITY_ENFORCED (Confused )
Currently if you include a field in a SQOL query that a user doesn't have access, the field is returned and can be used by the code, thus exposing the data to someone that should not have access to it....
- 6,426
Only top scored, non community-wiki answers of a minimum length are eligible