Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I would like to display different elements to a user depending on whether they have write permissions for a certain field, or just read permissions.

Is it possible to detect user permissions for a field simply on a visualforce page?

Thanks

share|improve this question

3 Answers 3

up vote 9 down vote accepted

You have two options here....

  1. Visualforce Components. By using the apex:inputField and apex:outputField components to accept and display data to the user, the platform will automatically respect the current users Field Level Security. Hiding the field if it is not visible to them or making it read only if they cannot edit it. This is the easiest way to implement field level security in your pages.
  2. Visualforce $ObjectType.. You can also access this information using the $ObjectType global variable, as describe here. There is also a very good Wiki article showing more examples here (see 'Manual CRUD and FLS Enforcement in VisualForce'). By removing the 'get' or 'is' prefix you can access any of the properties on the DescribeFieldResult object this way. A basic example is this.

    apex:outputText value="{!contactName}" rendered="{!$ObjectType.Contact.fields.Name.Accessible}"

  3. Apex. Although not strictly part of the Salesforce Security Review (at present). It is recommended that you check field level security in your Apex code as well. Though for complex code bases this is nearly impossible to maintain and keep up to date IMHO (some better platform support is needed here). In the meantime you can utilise the Apex Describe support to check this dynamically and if needed expose this information as bindings from your controller for which you can apply to the 'rendered' attribute on your components. Refer to this Wiki article for more information (see 'Manual CRUD and FLS Enforcement in Apex Controllers')

share|improve this answer
1  
It might also be possible to use the $Schema syntax to evaluate this in Visualforce markup, I need to research this more though. May update my answer later today. –  Andrew Fawcett Feb 6 '13 at 11:58
1  
Yes indeed $ObjectType does the trick. I've updated my answer to include all the options available. –  Andrew Fawcett Feb 6 '13 at 14:02

http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_methods_system_fields_describe.htm

There are describe field result methods in apex

Schema.DescribeFieldResult F = Account.AccountNumber.getDescribe();
f.isAccessible;
f.isUpdateable

The above methods may help you to figure the permissions the current user has on the field for Account Number of Account Object.

share|improve this answer

The $ObjectType global variable gives access to certain metadata from within formulas, including Visualforce page expressions.

As you probably know, all Visualforce expressions must be placed between two curlybracket-exclamation-close:

{!...}

The syntax for object metadata is:

{!$ObjectType.ObjectName.metadataPropertyName}

(italics not working in code formatting, so please leave formatting as is)

For instance:

{!$ObjectType.Account.labelplural} -> the plural label of the Account object
{!$ObjectType.Custom_Object__c.Queryable} -> Is the Custom Object Queryable

For field metadata it is a bit more involved: {!$ObjectType.ObjectName.fields.FieldName.metadataPropertyName}

Examples:

{!$ObjectType.Account.fields.Name.Label} -> the account's name field label
{!$ObjectType.Invoice__c.fields.Discount__c.Updateable} -> is this field editable
{!$ObjectType.Rock_Star__c.fields.Is_In_Treatment__c.Accessible} - is this field accessible

This is not a particularly well documented feature in the context of Visualforce, but all derives from the Schema DescribeFieldResult and DescribeSObjectResult classes in Apex, which are well documented in the Apex code developer guide.

I don't know which are or aren't surfaced in the $ObjectType global variable. But typically I just play with it to see. If you can only find a method (like isAccessible or getPrecision) drop the "is" or "get" from the method name and you've typically got it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.