Hot answers tagged

32 votes
Accepted

Lightning Experience: How to prevent the display of obsolete data?

Actually, this problem is due to the "aggressive" caching setting in LEX. Go to Setup Home > Security > Session Settings. Uncheck the option: Enable secure and persistent browser caching to improve ...
user avatar
13 votes
Accepted

What is the difference between creatable vs. updatable on Schema.DescribeFieldResult

Many fields cannot be changed once populated, such as Audit Fields. Run this script: for (SObjectField field : SObjectType.Account.fields.getMap().values()) { DescribeFieldResult describe = field....
user avatar
  • 144k
12 votes
Accepted

Most optimal way to Enforce CRUD/FLS in Apex

You could write a helper method for this type of functionality: public Object flsGet(SObject record, SObjectField field) { return !field.getDescribe().isAccessible() ? null : record.get(field); } ...
user avatar
  • 144k
8 votes
Accepted

Do we allow CRUD & FLS in each component of Apex?

Generally, code you've written is already CRUD- and FLS-safe, as long as you follow the basic guidelines regarding Visualforce elements (e.g. check FLS when not using apex:inputField, etc). You can ...
user avatar
  • 439k
8 votes

Security Review - CRUD/FLS Checks for every SOQL Query

You don't need to check every field that you query. The issue really boils down to who manages security for the field -- your app or the admin. With standard objects, the answer is always the admin. ...
user avatar
8 votes
Accepted

Field-Level Security (FLS) in Lightning Components

Since Winter 20 release, we have Security.stripInaccessible() method which strips the fields that the current user can’t access from query and subquery results. Since Spring 20 release Security....
user avatar
7 votes

Lightning Experience: How to prevent the display of obsolete data?

To disable the setting mentioned in Greg's answer for scratch orgs, disable S1EncryptedStoragePref2 in your project scratch def JSON: config/project-scratch-def.json { "orgName": "My Scratch Org"...
user avatar
7 votes
Accepted

How to test CRUD and FLS in unit tests?

There are a few different ways to attack this problem, but the most common is to create a user with permissions, and then use System.runAs to execute your tests. I normally grant permissions to my ...
user avatar
7 votes
Accepted

Get all field level permission from SOQL for an permission set

As mentioned by @benahm, SOQL on FieldPermissions retrieves only enabled field permissions for the permission set. Furthermore, as per chapter "Special Properties for Field Permissions" in ...
user avatar
  • 3,515
6 votes
Accepted

How do I check CRUD and FLS in apex?

Please refer to this knowledge article. Basically you just need to add some checks like if (!Schema.sObjectType.Contact.fields.Name.isAccessible()){ return ''; } or if (!Schema....
user avatar
  • 13.4k
6 votes

How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?

without sharing will not reinforce SFDC field level access and visibility, so you will be running your class on system context. In system context, Apex code has access to all objects and fields— ...
user avatar
6 votes

how to check FLS of sObject dynamically

You could do something like: ((sObject)Type.forName('Account').newInstance()).getSObjectType().getDescribe().isAccessible(); Or you could do a global describe and get the values from the returned ...
user avatar
  • 53.2k
6 votes
Accepted

Apex Source Scanner flag CRUD/ FLS as security risk for no reason

To help others who end up here, my response as an answer: From what you posted, looks like a false positive - so I would document it in review. Here is a link to a recent update from the SR team ...
user avatar
6 votes
Accepted

Disable Lightning Combobox in LWC based on FLS

Update How to get Object Describe in Lightning Web Component. You can get that using the uiObjectInfoApi module. import { LightningElement, wire } from 'lwc'; import { getObjectInfo } from 'lightning/...
user avatar
  • 10.9k
6 votes

Get all field level permission from SOQL for an permission set

As stated in the SOAP API Documentation FieldPermissions : Represents the enabled field permissions for the parent PermissionSet. This object is available in API version 24.0 and later. So ...
user avatar
  • 2,407
6 votes
Accepted

Why is stripInaccessible removing an M-D field?

It may well be related to whether or not your relationship is reparentable. If not, the field would not be updateable.
user avatar
  • 144k
5 votes

How does getSObjectType().getDescribe() work in a 'Without Sharing' Class?

All security-related methods, such as UserRecordAccess and the describe calls, will always return the user's real permissions. All that "without sharing" does is turns off the permission and sharing ...
user avatar
  • 439k
5 votes

CRUD & FLS on Managed Package Objects

Yes the CRUD/FLS are also important on the packaged objects .The decision to assign the permission set or not should be left with the org administrator and not something the package vendor can ...
user avatar
5 votes
Accepted

Checkmarx Scanner is useless for CRUD and FLS issues checking?

Checkmarx is not "useless," and, in fact, is very good at what it does. However, that's not to say that false positives are not possible. It can make mistakes. However, whenever you get a flag like ...
user avatar
  • 439k
5 votes
Accepted

How to best enforce CRUD/FLS and pass Security Review

The best option today I think is to largely avoid CRUD & FLS and enforce security via custom permissions aligned with your business processes but that is not really answering your question. Part ...
user avatar
5 votes

How to best enforce CRUD/FLS and pass Security Review

The answer was given by Chris Peterson (PM of Apex) and MVP Daniel Ballinger during Dreamforce '19 in the session "Reducing the Cost of Enforcing CRUD and FLS in the ESAPI". And the answer is: By ...
user avatar
5 votes
Accepted

2GP Create Package Version Fails when running tests

Using System.RunAs in your test methods is the recommended way to solve these in Test class execution. This ensures that the Test Execution context does not depend on the current user in the org. This ...
user avatar
4 votes
Accepted

Better way for Bulk Assignment of Field Level Security

Don't know of any tools that do this, but I'd do one of the following: Update a single profile via the UI to match the appropriate FLS, and then update the other profiles within the force.com IDE. i....
user avatar
  • 5,499
4 votes

Platform Encryption vs. FLS

Platform Encryption will go further than just preventing the users from seeing data, it will also encrypt the fields at the database level. For example, you can't even issue a SoQL query doing an "...
user avatar
4 votes

How to retrieve FLS settings for a custom field

You can query field permissions by using SOQL on the FieldPermissions object. For example: SELECT Id, Field, SObjectType, PermissionsRead, PermissionsEdit FROM FieldPermissions This would return a ...
user avatar
  • 7,047
4 votes

Any way to check a field's updateablity ignoring profiles?

The only reasonable method I know of is to use a try-catch block: try { record.put(someField, someValue); } catch(SObjectException e) { // Field could not be written } Unfortunately, this is an ...
user avatar
  • 439k
4 votes

Updating Record Name (auto-generated) using Process flow

You cannot update Auto Number fields, by nature. If you want to have a Name field that includes an Auto Number as well as some text derived from other fields on the record, you should add a non-Name ...
user avatar
  • 87.4k
4 votes

How to best enforce CRUD/FLS and pass Security Review

The most voted advice will get you failed at the security review. End-users rely on CRUD/FLS configurable from UI Setup, and they will get quite surprised that your app does not respect the standard ...
user avatar
  • 179
4 votes
Accepted

FLS check in 2GP

So in Apex Tests, you can use the RunAs feature to do this - basically, create a user in the test, assign a basic profile (the new Minimum Access one is helpful for this), and then assign the ...
user avatar
3 votes

Platform Encryption vs. FLS

After our meeting with a rep who walked us through Shield in more detail, he said basically there are two reasons to use Platform Encryption: You are worried someone is going to physically steal a ...
user avatar
  • 144k

Only top scored, non community-wiki answers of a minimum length are eligible