Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown.

Sometimes the logged in user will not have access to the VF page. I want to hide the dropdown item if they don't have access to it. I know you can do this with objects, via {!$ObjectType.objectname.accessible}, but can you do something similar with VF pages?

An alternative solution would be that the controller would throw an error message back to the page, but same issue applies - I still don't know how to get the accessibility of a VF page through apex.

share|improve this question

3 Answers 3

Profile rights can be queried although the data model is bit complex. Actual user's permissions depend on his Profile and any Permission Sets that were assigned to him on top of the Profile.

Start by looking at the data model: http://www.salesforce.com/us/developer/docs/api/Content/sforce_api_erd_profile_permissions.htm

Your data is hidden in the SetupEntityAccess and that help page lists some useful examples. Especially the last one looks very promising:

SELECT Id, SetupEntityId, SetupEntityType
FROM SetupEntityAccess
WHERE ParentId
IN
   (SELECT PermissionSetId 
   FROM PermissionSetAssignment
   WHERE AssigneeId = '005D0000001QOzF')
AND (SetupEntityId = '02uD0000000GIiMIAW')

Substitute the hardcoded variables with

  • UserInfo.getUserId()
  • result of SELECT Id FROM ApexPage WHERE Name = 'Foobar' AND NamespacePrefix = null
share|improve this answer
    
This is what worked for me: SELECT Id, Parent.Name, Parent.Profile.Name, Parent.Profile.Id FROM SetupEntityAccess WHERE Parent.Profile.Id = :UserInfo.getProfileId() AND SetupEntityId in (SELECT Id FROM ApexPage WHERE Name = 'MyPage' AND NamespacePrefix = null) –  willard Jun 17 '14 at 16:06
    
Post it as an answer, I'll happily upvote it and it'll mean that some future guy will have a query ready to use :) –  eyescream Jun 17 '14 at 17:24
    
But if you've used only the ProfileId then you'll get "false positives" when somebody gets access granted to that page via permission set. You'll decide to redirect because it's not included in his profile while in reality he might have been able to see the page after all. –  eyescream Jun 17 '14 at 17:48

I want to supplement eyescream's answer to avoid an additional SOQL-query, which returns Id of a page. So, the final block of SOQL-code may also look like this:

SetupEntityAccess[] accessSettings = [SELECT Id FROM SetupEntityAccess WHERE
    SetupEntityId IN (SELECT Id FROM ApexPage
        WHERE NamespacePrefix = :your_namespace AND Name = :your_page)
    AND
    ParentId IN (SELECT PermissionSetId FROM PermissionSetAssignment
        WHERE AssigneeId = :UserInfo.getUserId())
    LIMIT 1];


Description of system objects:

  • SetupEntityAccess stores mappings between setup entities (like, ApexPage, ApexClass and etc.) and PermissionSets.
  • PermissionSet object keeps not only real permission sets, but also permissions which come from profiles.
  • PermissionSetAssignment stores mappings between a user and PermissionSet.


Description of the logic:

We need to select all SetupEntityAccess-mappings for the passed page, which also refer to assignments related with the user. These assignments may come from permission sets or from the user's profile.

share|improve this answer

You can definitely check from setup --> Page --> security from the UI. As far as checking with apex I was not able find any direct param that lets you know the accessibility, but I think this could work:

1) Create a custom setting that has the list of profile that have access to the page you are redirecting the user.

2) See if the user.ProfileId (or) query to find user profile name is one of the custom setting values and disable the button that redirects the user/ pop up a visualforce error message instead of redirecting them to the "Insufficient privileges" page.

This is managing a duplicate list of security to the page and every time a new profile is given access to the page you need to update the custom setting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.