I've opened up a visualforce page on sites and on receipt of a private sms (using twilio) I'm trying to create a task. However everything seems to show this is not possible due to Public Access Settings. Is there no way to create tasks from a Force.com site?
A VisualForce Page Controller cannot do this on a Force.com Site. However, if you create a 2nd Apex Class that is Global, your controller can call a method in that class that inserts the Task.
Related
I am fixing soql injection errors in my Salesforce org. How do I find out where that page is being called from in Salesforce? I tried looking at the 'Where is this used?" button under setup/Visualforce page/edit/ and it just shows me the test that it is being called from. I checked the show dependencies and it shows me the controller that it is associated with. I can't seem to figure how I can access the page in Salesforce so I can do a manual test on it.
Create a sandbox and try to delete it in there. If page is "properly" used - dependency should block the delete. Can be custom VF tab, button, link, embed on page layout as iframe... Can even be in community or Site as a login page for example.
If you have the project in git or sfdx you could try searching for page's API name.
But pages can be also accessed freestyle, in classic UI you used to just /apex/vfpagename in the address bar. In lightning it's bit more complex but doable for a determined user.
If you want to block access while you fix it - remove right to use the page from profiles / permission sets.
https://salesforce.stackexchange.com/a/12672/799
https://lightning-configuration.salesforce.com used to give some info about VF pages usage (count of hits I think) and there's whole Event Monitoring module paid extra (standalone or as part of Salesforce Shield) too
I am learning Salesforce and am working on the following Trailhead unit:
https://trailhead.salesforce.com/content/learn/modules/identity_external/identity_external_social?trail_id=identity
(Setting up a social sign on for the sandbox environment)
I make an authenicated provider (google) by going to setup -> auth -> auth providers
For the registration handle I click 'Let salesforce create an automatic registration handler'
I then go to setup -> find-> apex classes, find the newly created apex class. I delete the code that is in the apex class and insert the code that is available here:
https://github.com/salesforceidentity/IdentityTrail-Module3/blob/master/Module3RegistrationHandler.cls
According to trailhead, the code should be active, and the social sign on for google should now work. However, when I go to save it, I get the following message:
" Error: Class name is already in use or has been previously used "
So, how do I save my edits to Apex?
What is this error and why am I getting it?
I'm assuming then that when edit the text inside an apex class, and go to save, that it's not over-writing the current apex class; rather, that it's trying to make a separate instance of the same class with the same name, and is throwing an error. I would appreciate any assistance on to how I can successfully edit this APEX class!
Ok - so I checked, and it looks like when I had previously saved one of these apex classes, the class name in the code is module3registrationhandler and it auto created another class in the drop down list. so when I tried again to save it from the autocreatedhandler, it said that you had previously done this. Error found. Salesforce rejects duplicates.
I am trying to use Logic Apps to create a new page in my OneNote book whenever a new email comes from some particular DL. Now my query is how do I name my new page automatically as the OneNote connector in LogicApps doesn't provide that option?
I have tried changing the logic app json code but not able to find the correct logic where it needs to be changed.
The Page Content is just HTML. You basically need to set the head > title for the title of the page.
I know this feature is available for the old Salesforce UI, but couldn't find anywhere how to pre-populate recipients using Docusign Lightning component.
Has anybody been able to solve it?
With SalesForce "classic" you could use a JavaScript button to prepopulate recipient info when the DocuSign Envelope is created. However, it appears that SalesForce Lightening does not support JavaScript buttons.
To customize "Send with DocuSign" behavior in SalesForce Lightening, you might try the following approach:
Create a Visualforce page that launches an APEX class controller that opens a URL.
Create a class to define that controller.
Create a new action on the opportunity and associate the Visualforce page to the action.
Add the Action to the appropriate area on the Opportunity page layout.
You can find a code sample for this type of implementation on this thread in the SalesForce Developer forum: https://developer.salesforce.com/forums/?id=906F0000000BWr4IAG. And, this other SO post shows an attempt to implement this approach to customize the Send with Docusign behavior: Customize "Send With Docusign" in Salesforce Lightning.
Note: I'm not a SalesForce developer and this answer is simply recommending an approach that others seem to have used in the scenario you've described.
I'm looking for a technique to execute Apex code from a custom button added to the Opportunity object in a way that protects the user against CSRF.
The current approach being used comes from the question - Custom Button or Link to a Visualforce page with a custom controller. Essentially:
There is an Opportunity Custom Button with the Content Source set to "Visualforce Page".
The Content for this button is set to a Visualforce page that uses Opportunity for the standardController, has an extension apex class entered and an action for a method in that class
The action method returns a PageReference to another custom Visualforce page, including adding a parameter with the Opportunity Id.
This second custom Visualforce page does the bulk of the actual work, including making web service callouts and performing DML operations before redirecting the user back to the Opportunity.
The issue with this approach is that the second custom Visualforce page is retrieved via an HTTP GET, pulls parameters from the query string, and performs update/insert DML operations with no CSRF protection. This is being picked up by the Force.com Security Source Code Scanner.
I should add that this apex code is deployed as both a managed and a unmanaged package, hence the extra work to redirect to the target Visualforce Page using a PageReference. This ensures the namespace prefix is added if required.
How can I avoid the CSRF issue?
I don't want to add a form to the second visualforce page with a button that they must press to start the process (and hence picking up the ViewStateCSRF protection in the postback). From the users perspective they have already pressed the button to perform the operation.
I've asked this question before on the developer force forum and didn't come up with a solution - Cross-Site Request Forgery (CSRF/XSRF) safe Custom Button action
Perhaps I should be trying to move the code out of the controller for the second visual force page and using the extension to the stand controller instead?
I could switch to a Javascript callback to an Apex Web Service (as suggested in Call a apex method from a custom button and How invoke APEX method from custom button), but it seems a bit messy and I'm not sure if I'd just be opening up another range of security issues with the web service.
I booked Partner Security Office Hours with Salesforce and discussed this issue directly with them.
What I'm trying to do isn't currently supported if CSRF protection is required (I.e. to publish to the App Exchange). They suggested two alternative approaches:
Create an intermediate form in a Visualforce page that triggers the sensitive Apex Code. Hence picking up the built in CSRF protection.
Override the Opportunity Detail page (using apex:Details to display similar information). This new Visualforce page would include a similar form post back to option 1 to invoke the sensitive APEX code and get automatic CSRF protection.
Another approach that doesn't use custom buttons is to embed/inline a Visualforce page (see Embed a Page on a Standard Layout) containing just the required button within the standard page layout.
The embedded Visualforce page must use the standard object controller (Opportunity in my case) to appear in the list of available Visualforce pages on the standard page layout. The Visualforce page itself can be very minimal with just a commandButton inside a <apex:form>. The label of the Visualforce page can also be displayed in the page layout.
<apex:page id="embeddedPage" StandardController="Opportunity" extensions="OpportunityExtensionController" showHeader="false" standardStylesheets="true">
<apex:form >
<apex:commandButton value="CSRF Safe Button" action="someMethodInTheExtensionClass" />
</apex:form>
public with sharing class OpportunityExtensionController {
private final Opportunity opportunityFromController;
public OpportunityExtensionController(ApexPages.StandardController controller) {
opportunityFromController = (Opportunity)controller.getRecord();
}
public PageReference someMethodInTheExtensionClass() {
// Perform directly here within the postback rather than redirecting to another page to prevent against XSRF
System.debug('opportunityFromController.Id:' + opportunityFromController.Id);
}
}
This should protect against CSRF as the commandButton will pick up the "com.salesforce.visualforce.ViewStateCSRF" hidden input with the post back to the server inside the resulting iframe.
I've raised the Idea Invoking Apex code from the standard Entity Details pages with CSRF protection to see if they can add support for this directly with custom buttons.
Why don't you use a JavaScript button in the first place to launch the second page? Bypass the first page altogether.
Salesforce will apply merging to the script before rendering (so you can use {!Opportunity.Id} to include opp id in the second URL) and you can simply redirect the browser to your second page.