#SecureCommunities0 人がディスカッション中

Hello,

Not sure if it is here that we should post, but I have enabled all the Security Updates, now we are testing our App and checking the steps that our customers need to do.

The scenario that I am testing is that the UserA(Admin) created Record_A in Object_A and associated it with Record_B from Object_B which our App on Post Install have created the Record_B.

The Record_A has owner as UserA and Created By UserA.

The Record_B has owner as our App Name, and the Created By is by the UserA.

When I load the VisualForcePage in Site.com with a Guest User, I cannot see the Record_B. I can see the Record_A. If I look at the log we do a query on Record_B nothing shows with the right ID, but we don't get anything.

I am wondering if I have missed any configuration. Any ideas?

Those are the configuration that I have set already:

- Sharing Settings

-- Enabled/Checked - Secure Guest user Record access.

-- Added a Sharing Rule for Object_A and Object_B for Guest User

- Permission on Guest User

-- Added a permission set to my guest user to access the controller, VSF and our objects.

-- Guest Profile removed all the All Modify/All View

Things that I have tried and worked.

1. If I changed the owner to be the same as the Created By, it worked. Although I don't think this is the best solution, because we didn't say that the owner will be our App.

2. If I go to the Guest Profile >> Edit >> Go to Object_B and enabled View All only, the record shows.

Thank you in advance!

#SecureCommunities  #Securesites #SecureMyGuestUser 

We are preparing our products suite for Winter20 security changes and facing issues with Site inserting and retrieving record in same context/transaction.

@George Abboud - Based on your recommendation, Read access will need to be granted via Guest Sharing Rules, and Edits will need to be done via Apex methods running in without sharing mode. But this does not work when Site inserts a record and retrieve that record in same context. Please check below implementation for creating and updating Contact from site -

1. Guest sharing rule on contact with criteria created by user not equal to null. Technically, Site guest user should be able to read all contacts.
2. Site guest user insert contact and retrieve contact in with sharing class. Technically, this should work because site user has create contact permission on profile and sharing guest rule to read created contact. But no contact is retrieved, please check below snippet code:

//Step 1- insert from site

contact c = new Contact();

c.lastname = 'Test';

insert c;

//Step 2 - retrieve from site

c = [Select Id,LastName from Contact Where Id = :c.id];

We are not able to retrieve inserted contact and due to this we need to move our read logic into without sharing apex class for sites. We want to highlight this because Appexchange Security review team does not allow without sharing apex and takes months to approve.

Please share your thoughts.

Thanks

Manish