In Classic, sforce.interaction.saveLog() is not respecting FLS
API , CTI , Platform , Custom Objects
Last updated 2020-08-10 ·Reference W-7332960 ·Reported By 0 users
No Fix
Summary
When sforce.interaction.saveLog() is used to insert records into Object, FLS (Field Level Security) of the context user is not enforced.
Repro
1. Create the following VF page and relevant objects/fields in the org
<apex:page sidebar="false" showHeader="false">
<head>
<script src="/support/api/47.0/interaction.js" type="text/javascript"></script
<script type="text/javascript">
var callback = function (response) {
if (response.result) {
alert(response.result);
} else {
alert(response.error);
}
}
function saveLog() {
sforce.interaction.saveLog('CTI_Call_Log__c','Name=CTILog1&FLS_Test_Field__c=testvalueClassic', callback);
}
</script>
</head>
<button onclick="saveLog();">saveLog</button>
</apex:page>
2. Use the following article to create call center for Classic and expose the VF page via the call center:
https://developer.salesforce.com/docs/atlas.en-us.api_cti.meta/api_cti/sforce_api_cti_call_def_file_sample.htm
3. Add CTI user to the call center.
4. Ensure that the CTI user does not have FLS access to the field which is being tested using the VF page.
5. Login as the CTI user and test using the VF page.
Workaround
Remove the fields from the saveLog() request.
Reported By (0)
Is it Fixed?
Any unreleased services, features, statuses, or dates referenced in this or other public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make their purchase decisions based upon features that are currently available.
