#Guest User Security0 人がディスカッション中

The Run Flows permission will be removed from all orgs starting in the Summer ‘22 release. To avoid future access issues, we recommend updating your existing sites to the new permission structure before the Summer ‘22 release. To update your flows, select Override default behavior and restrict access to enabled profiles or permission sets and provide granular flow access for your guest users.  Now I follow the steps of :

- create a flow.

-Click edit access

-Enable Override default behavior and restrict access to enabled profiles or permission sets

-Go to guest user profile and enable the flow

When I go to the community the flow doesn't run, what is happening?Do I need make something more?

The documentation I followed is : https://help.salesforce.com/s/articleView?id=sf.flow_distribute_security.htm&type=5 

Thank you in advance!

@* Salesforce Administrators * #Experience Cloud #Flow #Site Guest User #Secure Guest User

#Security

#LWC  #Guest User Security  #Lightning Experience

I have a question. Imagine that in a salesforce org there is an object called Form__c. This object stores all the fields of a form that is hosted as a visual force page.  If I remove object level Read/Write access and sharing settings, will guest users still be able to access it? In my org I have: 1) Removed all sharing settings for guest users 2) Disabled API access/apex Rest service 3) Restricted FLS read/write.  It seems the Guest users can still access records, how does that fit in?  #Guest User Security #Site Guest User #Guest Users #Guest User Security #Security 

Back when the whole Guest User Security thing started, I ran into an issue with queries to certain setup objects from Guest Users.  The metadata reported that the objects where inaccessible when should be.  In order to work around that issue, I have one class that is declared without sharing that does not do CRUD/FLS checks.  This class queries Group, GroupMember, UserRole, and OrgWideEmailAddress.

Anyone know if that issue has been fixed? 

We're about to go through security review and if the issue is fixed, I can change the class declaration and add WITH SECURITY_ENFORCED to the queries.  If the issue is not fixed, I'll have to document it as a false positive.

Regarding the Guest User Security update, I am following the guide here: https://www.learnexperiencecloud.com/s/article/Guest-User-Record-Access-Development-Best-Practices

The examples for moving DML statements to a without sharing class make a lot of sense, but I am struggling to understand the examples for the encryption/decryption concepts.

The guide makes a lot of assumptions regarding the developer's  understanding of encryption/decryption, and doesn't explain that part as much. My follow up questions after reading this:

1) Are there any other resources regarding the concept of " encryption / decryption " we could reference to understand better what the examples in the guide are doing?

2) Do I need to apply encryption/decryption to be compliant with the Guest User Security update, or is it just a best practice suggestion? I'm struggling to understand how the Guest User Security update necessitates encrypt/decrypt. 

The need to abstract DML statements to a without sharing class makes a lot of sense, but I am lacking context for the encryption/decryption requirement/recommendation. 

Hi,

can anyone please confirm whether Guest User Security settings in Summer'20 will impact the communities without "Public Access" enabled? I was confused that the release note says that "These changes affect all customer organizations with Salesforce public sites built on site.com, force.com, or communities." But I am not sure what is a public sites built on site.com, force.com, or communities.

And another question is whether all communities allow guest user to access? 

Any comments and suggestions on my questions is highly appreciated.

Best regards,

Faxue Zhang

Hi everyone:

I have an "Unauthenticated Community" that comes with the Enterprise Edition, set to "Public Access," but the Tile Menu, Knowledge Articles, and all other pages are still locked behind the Login Page.

Do I need to manually assign the Guest User Profile to users or change the site's "Public Access Settings?"

Your insights would be greatly appreciated!

Thank you in advance!

Can we use  https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FR6GaUAL

this package for lightning communities reports?

@Fabrice Talbot We applied the "Secure guest user record access" setting to test and can no longer revert it back in one of our Partner Developer orgs. The org is currently on Spring 20. I thought this was going to be enforced with Summer 20.