Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

There is a field named "Email Opt Out" in the contact object. Can we query this field and put in the filter condition if the "Email Opt Out" field does not have both "Field-Level Security" and "Field Accessibility" in the apex class.

share|improve this question
    
What filter condition? –  PJC Jan 9 '13 at 10:24
    
In SOQL where condition. –  Ugesh Gali Jan 9 '13 at 10:25
add comment

2 Answers 2

up vote 4 down vote accepted

Apex doesn't enforce FLS:

Although Apex doesn't enforce object-level and field-level permissions by default, you can enforce these permissions in your code by explicitly calling the sObject describe result methods (of Schema.DescribeSObjectResult) and the field describe result methods (of Schema.DescribeFieldResult) that check the current user's access permission levels. In this way, you can verify if the current user has the necessary permissions, and only if he or she has sufficient permissions, you can then perform a specific DML operation or a query.

http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_classes_perms_enforcing.htm

Therefore:

  • You can use user-inaccessible fields in a SOQL where clause
  • You can select user-inaccessible fields in a SOQL query, and so if you serialize an sObject in Apex you will include all selected fields, whether accessible to the user or not
share|improve this answer
add comment

Yes,

You can perfectly query a field in a SOQL query that isn't visible to the user, you can filter on it, but you won't see it in visualforce or in the layout.

Unless you make the field visible ofcourse.

share|improve this answer
    
Thank you tested worked fine but I am returning a JSON which returns me the hidden field value. –  Ugesh Gali Jan 9 '13 at 10:32
    
Could you elaborate a little more, are you just serializing the contact object? Are you creating a new object? What are you planning to do with the json string? where are you using it? –  PJC Jan 9 '13 at 10:34
    
string testQry = 'Select Id, Name, Account.name, Account.Id, Email,EmailBouncedDate From Contact WHERE HasOptedOutOfEmail = true'; return as JSON.serialize(database.query(testQry )); returns hidden field also. –  Ugesh Gali Jan 9 '13 at 10:51
    
this is correct, As you can see on the answer below, apex ignores field level security. By querying the data in soql, and serialising them in apex, you get the data like they exist in the database –  PJC Jan 9 '13 at 12:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.