Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

So I have a VF page that calls some other VF pages based on a button click. The button will reroute to a different VF page depending on a value within a dropdown.

Sometimes the logged in user will not have access to the VF page. I want to hide the dropdown item if they don't have access to it. I know you can do this with objects, via {!$ObjectType.objectname.accessible}, but can you do something similar with VF pages?

An alternative solution would be that the controller would throw an error message back to the page, but same issue applies - I still don't know how to get the accessibility of a VF page through apex.

share|improve this question

2 Answers 2

Profile rights can be queried although the data model is bit complex. Actual user's permissions depend on his Profile and any Permission Sets that were assigned to him on top of the Profile.

Start by looking at the data model: http://www.salesforce.com/us/developer/docs/api/Content/sforce_api_erd_profile_permissions.htm

Your data is hidden in the SetupEntityAccess and that help page lists some useful examples. Especially the last one looks very promising:

SELECT Id, SetupEntityId, SetupEntityType
FROM SetupEntityAccess
WHERE ParentId
IN
   (SELECT PermissionSetId 
   FROM PermissionSetAssignment
   WHERE AssigneeId = '005D0000001QOzF')
AND (SetupEntityId = '02uD0000000GIiMIAW')

Substitute the hardcoded variables with

  • UserInfo.getUserId()
  • result of SELECT Id FROM ApexPage WHERE Name = 'Foobar' AND NamespacePrefix = null
share|improve this answer
    
This is what worked for me: SELECT Id, Parent.Name, Parent.Profile.Name, Parent.Profile.Id FROM SetupEntityAccess WHERE Parent.Profile.Id = :UserInfo.getProfileId() AND SetupEntityId in (SELECT Id FROM ApexPage WHERE Name = 'MyPage' AND NamespacePrefix = null) –  willard Jun 17 at 16:06
    
Post it as an answer, I'll happily upvote it and it'll mean that some future guy will have a query ready to use :) –  eyescream Jun 17 at 17:24
    
But if you've used only the ProfileId then you'll get "false positives" when somebody gets access granted to that page via permission set. You'll decide to redirect because it's not included in his profile while in reality he might have been able to see the page after all. –  eyescream Jun 17 at 17:48

You can definitely check from setup --> Page --> security from the UI. As far as checking with apex I was not able find any direct param that lets you know the accessibility, but I think this could work:

1) Create a custom setting that has the list of profile that have access to the page you are redirecting the user.

2) See if the user.ProfileId (or) query to find user profile name is one of the custom setting values and disable the button that redirects the user/ pop up a visualforce error message instead of redirecting them to the "Insufficient privileges" page.

This is managing a duplicate list of security to the page and every time a new profile is given access to the page you need to update the custom setting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.