Guest User: Guest User Security Policies Enforced

In Winter ’21, Salesforce is enforcing guest user security policies introduced in the past few releases, such as the Secure guest user record access setting. Also, Salesforce is reducing object permissions for guest users.

Secure Guest User Record Access Can’t Be Disabled
The Secure guest user record access setting was enabled in Summer ’20, but could still be disabled during that release. To safeguard your Salesforce org’s data, in Winter ’21, this setting is enabled in all orgs with communities or sites and can't be disabled. The Secure guest user record access setting enforces private org-wide defaults for guest users and requires that you use guest user sharing rules to open up record access. You also can't add guest users to groups or queues or grant guest users record access through manual sharing or Apex managed sharing.
Automatically Assign Records Created by Guest Users to a Default Owner (Previously Released Update)
To increase the security of your Salesforce data,guest users are no longer automatically the owner of records they create. The Assign new records created by guest users to the default owner setting is automatically enabled in all orgs with communities, and can’t be disabled. When a guest user creates a record, the record is assigned to a default active user in the org, who becomes the owner.
Reduce Object Permissions for Guest Users
With the Winter ’21 release, Salesforce is disabling the View All, Modify All, edit, and delete object permissions for guest users in existing orgs. These permissions are removed from orgs created in Winter ’21 and later. For existing orgs, reduce object permissions for guest users if they have View All, Modify All, edit, or delete permissions on a standard or custom object.
Opt Out of Enforcing Guest User Object Permission Changes (Previously Released Update)
For Salesforce orgs created before Winter ’21, this update opts your org out of enforcing guest user object permission changes aimed at increasing your data security.
View All Users and Other Permissions Removed in Guest User Profiles (Previously Released Update, Enforced)
Guest users typically don’t need access to view all users in a Salesforce org, so to promote data security, we disabled the View All Users permission in guest user profiles with the Summer ’20 release. The permission is removed from all guest user profiles with the Winter ’21 release. To enhance security, we also removed these permissions from the guest user profile: Enable UI Tier Architecture, Remove People from Direct Messages, View Topics, and Send Non-Commercial Email.
Let Guest Users See Other Members of This Community Setting Disabled
With the Winter '21 release, the setting, Let guest users see other members of this community, is turned off by default in all Salesforce orgs that have active communities with at least one community created before the Winter '20 release.
Improved Security for Managed Topic Images
Managed topic images that were uploaded before Winter ’21 are stored as documents and are public. Guest users can see these featured and navigational topic images even in private and unpublished communities. To improve security, new images associated with featured and navigational topics are stored as asset files and are private. Ensure that guest users in your community can see these new images.
Override Entity Permissions When Using <apex:inputField>
The new ignoreEditPermissionForRendering attribute on <apex:inputField> allows you to override entity edit permissions for users, even when the underlying permission on the object doesn’t allow edits. This override affects all users but is intended to be used only for guest users. This attribute works only with a custom controller in without sharing mode.

No matches found