8/9/20 Critical Update Makes Managed Package Unusable

[eyeary]

We have activated the critical update "Restrict Access to @AuraEnabled Apex Methods for Authenticated Users Based on User Profile" in our org, and it breaks the sortable data grid managed package. This update will automatically go into affect across all orgs on 8/9/20.

Basically this update means that we have to authorize access on a per profile basis to any classes containing @AuraEnabled methods for Lightning and LWC components that we want our users to use. By activating this update, our users lost the ability to use the sortable data grid because they did not have access to the class sdgController.

Because of a separate Salesforce policy, I am unable to change the security settings for sdgController. System Admins can only change the security settings for apex classes in managed packages if the classes are declared global. Looking at your source code, sdgController is declared public, meaning that I cannot assign this class to our Profiles and rendering it unusable.

Can you update sdgController in the managed package to declare it global?

[wallnern]

I had the same problem but I changed the setting on the Profile: Profile --> Apex Class Access --> Edit --> Add the required classes e.g. the sdgController (the list of classes is not in alphabetical order - had to look through the whole list!). That worded on my side.

[eyeary]

I had the same problem but I changed the setting on the Profile: Profile --> Apex Class Access --> Edit --> Add the required classes e.g. the sdgController (the list of classes is not in alphabetical order - had to look through the whole list!). That worded on my side.

They are alphabetized by namespace/package first and then by class name. But sdgController doesn't appear on that list for us.

[wallnern]

Here it is a alphabetical (either Class Name or Namespace/Class Name but 2 parts - don't now the logic behind. This package is in the second part - on the very end. Attached a screenshot. Class is in there (in our Org).

[eyeary]

It doesn't show up there for us. Is it possible you're not using the managed package version of this from the appexchange but installed the code manually?

[wallnern]

We installed the managed package version 3.37 which is as far as I know the latest version.

[schieco]

Hi @eyeary,

James Brown from Salesforce pointed this out to me: https://trailblazer.salesforce.com/issues_view?id=a1p300000008cWxAAI which might be why you can't see all of the files in the managed package. It's why I couldn't.

Cheers, Sara

[eyeary]

@schieco That is interesting. With that trick I can see sdgController on the apex permission page for a specific profile. However, I think that's actually a glitch with the Enhanced Profile User Interface Page. I can add permissions on the profile page, but under the Apex Classes menu there is no security option for sdgController. That + my research on what I said initially in my post makes me think we aren't supposed to be able to modify those permissions, but for some reason they are available on the enhanced profile page. Thanks for the interesting loophole.

[jcombarros]

Thank you @wallnern . I checked it and it is feasible to add such apex permission to a Permission Set / Profile and works fine. On the other hand, the proper solution would be: since SortableDataGrid managed package offers 2 permissions (View / Edit Sortable Data Grids) set to manage the app, add permissions to apex class sdgController into those permission sets, but I am getting a System error when I save it:

--> Please fix the following: entity=SetupEntityAccess, component=0J03H000000rTVy, field=KeyPrefix, state=installed