search

pegros / PEG_LIST

Set of configurable/actionable LWC list components for Salesforce Lightning UX
MIT License
20 stars 9 forks source link

[feat] sfpegListCmp - enforce FLS on returned data in SOQL mode #21

Closed pegros closed 2 years ago

pegros commented 2 years ago

Is your feature request related to a problem? Please describe. Currently sharing is enforced (and possibly bypassed if needed) but FLS may be checked in SOQL queries only by explicitly setting the "WITH SECURITY_ENFORCED" keyword. This is not optimal as users get error messages as soon as they cannot access one of the fields displayed in the results.

Describe the solution you'd like The idea would be to automatically filter out fields the user has not access to and display a data-table with the remaining information only. This feature should be possibly bypassed if needed in the configuration (e.g. leveraging a custom permission).

Describe alternatives you've considered Leverage the Security.stripInaccessible Apex feature after the SOQL queries.

Additional context Add any other context or screenshots about the feature request here.

pegros commented 2 years ago

Implemented in commit bcce42a Added flags to bypass FLS controls (via Security.stripInaccessible() in AccessType.READABLE). Also added a flag to bypass single quote escaping to prevent SOQL/SOSL injection