Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know how to restrict users and profiles from accessing Visualforce pages at all. But there are cases where a profile is generally allowed to use a page but a specific user might fail to perform an action due to complex permission settings (MDR, child objects, ...)

I have a page where users will spend a lot of time before clicking Save the first time and then learn that they are not allowed to do this.

What is the best way to check this as soon as they go on this page?

I thought of using the <apex:page action=""> attribute. Is that a feasible way?

share|improve this question
Is this a native or Visualforce page or both? – Andrew Fawcett Jan 7 '14 at 12:58
This is a Visualforce page with a custom controller extension. – Robert Sösemann Jan 7 '14 at 13:32

If you are editing an existing record, you can use the UserRecordAccess object to see a user's permissions to that record. In your extension constructor, query the record's permissions to see what access the user has to that specific record.

share|improve this answer
There is no need to query this. It's in the Schema objects. – Robert Sösemann Jan 7 '14 at 15:33
You have to query it for existing records. The schema just tells you whether or not the user generally has permissions. Ownership and sharing rules can impact which records a user can edit. – Daniel Hoechst Jan 7 '14 at 15:40

I ended adding an Apex-only based check to my controller's constructor

private void checkPermissions() {
    if(!Schema.sObjectType.MyObject__c.isUpdateable() && ...) {
        Utils.showMessage(ApexPages.Severity.ERROR, 'You have insufficient privileges. Please contact an Administrator.');
share|improve this answer
I'd go with ||, not && :P And while it's good idea to have some checks server-side, you can use {!$ObjectType.objectname.accessible}, {!$ObjectType.objectname.createable} in pure VF to control <apex:pageMessage rendered or <apex:commandButton disabled too. – eyescream Jan 7 '14 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.