32
votes
Accepted
Lightning Experience: How to prevent the display of obsolete data?
Actually, this problem is due to the "aggressive" caching setting in LEX. Go to Setup Home > Security > Session Settings. Uncheck the option: Enable secure and persistent browser caching to improve ...
- 661
13
votes
Accepted
What is the difference between creatable vs. updatable on Schema.DescribeFieldResult
Many fields cannot be changed once populated, such as Audit Fields. Run this script:
for (SObjectField field : SObjectType.Account.fields.getMap().values())
{
DescribeFieldResult describe = field....
- 147k
12
votes
Accepted
Most optimal way to Enforce CRUD/FLS in Apex
You could write a helper method for this type of functionality:
public Object flsGet(SObject record, SObjectField field)
{
return !field.getDescribe().isAccessible() ? null : record.get(field);
}
...
- 147k
8
votes
Accepted
Field-Level Security (FLS) in Lightning Components
Since Winter 20 release, we have Security.stripInaccessible() method which strips the fields that the current user can’t access from query and subquery results.
Since Spring 20 release Security....
- 7,306
8
votes
Security Review - CRUD/FLS Checks for every SOQL Query
You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. ...
- 3,166
7
votes
Lightning Experience: How to prevent the display of obsolete data?
To disable the setting mentioned in Greg's answer for scratch orgs, disable S1EncryptedStoragePref2 in your project scratch def JSON:
config/project-scratch-def.json
{
"orgName": "My Scratch Org"...
- 333
7
votes
Accepted
How to test CRUD and FLS in unit tests?
There are a few different ways to attack this problem, but the most common is to create a user with permissions, and then use System.runAs to execute your tests.
I normally grant permissions to my ...
- 12.9k
7
votes
Accepted
Get all field level permission from SOQL for an permission set
As mentioned by @benahm, SOQL on FieldPermissions retrieves only enabled field permissions for the permission set.
Furthermore, as per chapter "Special Properties for Field Permissions" in ...
- 3,827
6
votes
Accepted
How do I check CRUD and FLS in apex?
Please refer to this knowledge article.
Basically you just need to add some checks like
if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){
return '';
}
or
if (!Schema....
- 14.7k
6
votes
How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?
without sharing will not reinforce SFDC field level access and visibility, so you will be running your class on system context.
In system context, Apex code has access to all objects and fields—
...
- 3,889
6
votes
how to check FLS of sObject dynamically
You could do something like:
((sObject)Type.forName('Account').newInstance()).getSObjectType().getDescribe().isAccessible();
Or you could do a global describe and get the values from the returned ...
- 53.6k
6
votes
Accepted
Apex Source Scanner flag CRUD/ FLS as security risk for no reason
To help others who end up here, my response as an answer:
From what you posted, looks like a false positive - so I would document it in review.
Here is a link to a recent update from the SR team ...
- 13.2k
6
votes
Accepted
Disable Lightning Combobox in LWC based on FLS
Update How to get Object Describe in Lightning Web Component.
You can get that using the uiObjectInfoApi module.
import { LightningElement, wire } from 'lwc';
import { getObjectInfo } from 'lightning/...
- 11.4k
6
votes
Get all field level permission from SOQL for an permission set
As stated in the SOAP API Documentation
FieldPermissions : Represents the enabled field permissions for
the parent PermissionSet. This object is available in API version 24.0
and later.
So ...
- 2,487
6
votes
Accepted
Why is stripInaccessible removing an M-D field?
It may well be related to whether or not your relationship is reparentable. If not, the field would not be updateable.
- 147k
5
votes
How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?
All security-related methods, such as UserRecordAccess and the describe calls, will always return the user's real permissions. All that "without sharing" does is turns off the permission and sharing ...
- 461k
5
votes
CRUD & FLS on Managed Package Objects
Yes the CRUD/FLS are also important on the packaged objects .The decision to assign the permission set or not should be left with the org administrator and not something the package vendor can ...
- 88.9k
5
votes
Accepted
Checkmarx Scanner is useless for CRUD and FLS issues checking?
Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like ...
- 461k
5
votes
Accepted
How to best enforce CRUD/FLS and pass Security Review
The best option today I think is to largely avoid CRUD & FLS and enforce security via custom permissions aligned with your business processes but that is not really answering your question.
Part ...
- 191
5
votes
How to best enforce CRUD/FLS and pass Security Review
The answer was given by Chris Peterson (PM of Apex) and MVP Daniel Ballinger during Dreamforce '19 in the session "Reducing the Cost of Enforcing CRUD and FLS in the ESAPI".
And the answer is: By ...
- 36.4k
5
votes
Accepted
2GP Create Package Version Fails when running tests
Using System.RunAs in your test methods is the recommended way to solve these in Test class execution.
This ensures that the Test Execution context does not depend on the current user in the org. This ...
- 88.9k
4
votes
Accepted
Better way for Bulk Assignment of Field Level Security
Don't know of any tools that do this, but I'd do one of the following:
Update a single profile via the UI to match the appropriate FLS, and then update the other profiles within the force.com IDE.
i....
- 5,949
4
votes
Platform Encryption vs. FLS
Platform Encryption will go further than just preventing the users from seeing data, it will also encrypt the fields at the database level. For example, you can't even issue a SoQL query doing an "...
- 12.9k
4
votes
How to retrieve FLS settings for a custom field
You can query field permissions by using SOQL on the FieldPermissions object.
For example:
SELECT Id, Field, SObjectType, PermissionsRead, PermissionsEdit FROM FieldPermissions
This would return a ...
- 7,107
4
votes
Any way to check a field's updateablity ignoring profiles?
The only reasonable method I know of is to use a try-catch block:
try {
record.put(someField, someValue);
} catch(SObjectException e) {
// Field could not be written
}
Unfortunately, this is an ...
- 461k
4
votes
Updating Record Name (auto-generated) using Process flow
You cannot update Auto Number fields, by nature.
If you want to have a Name field that includes an Auto Number as well as some text derived from other fields on the record, you should add a non-Name ...
- 90.1k
4
votes
How to best enforce CRUD/FLS and pass Security Review
The most voted advice will get you failed at the security review. End-users rely on CRUD/FLS configurable from UI Setup, and they will get quite surprised that your app does not respect the standard ...
- 189
4
votes
Accepted
FLS check in 2GP
So in Apex Tests, you can use the RunAs feature to do this - basically, create a user in the test, assign a basic profile (the new Minimum Access one is helpful for this), and then assign the ...
- 13.2k
4
votes
Accepted
FLS in SOQL - VisualForce vs LWC
The experience you get with LWC entirely depends on whether you use standard components or your own code.
In Visualforce you get FLS automatically applied when you use the apex:outputField or apex:...
- 31.2k
3
votes
CRUD and FLS enforcement
So
Yes its of course possible you can do it in two ways (which essentialy are the same)
Schema.sObjectType.Account.isUpdateable()
and
Account.sObjectType.getDescribe().isUpdateable()
if (!Schema....
- 2,082
Only top scored, non community-wiki answers of a minimum length are eligible