0

I have Opportunity OWD set to Private.

Have over ridden the NEW,EDit,View and Clone buttons of Opportunity with VF page.

I created opp record with USER1.

Logged in as USER2 and still able to see the Opp record(which is a VF page).

Does assigning VF page to buttons violate the OWD..??

Thanks in advance..!!

Improve this question
2
  • Is there a custom controller behind the page? If so, you sure it has "with sharing" in it's declaration?
    – user254875486
    May 17, 2016 at 14:03
  • Hey, I have Opp OWD set to private. i am sending an email on Opp creation to certain set of Users. Say user1 created Opp and mail is sent to User1,user2,User3. I want all 3 users to be able to view the record when clicked on link.
    – Laxman
    May 17, 2016 at 15:11

1 Answer 1

Reset to default
2

Objects and field access:

A visual force page will enforce FLS and CRUD if the fields are binded as sObject fields using input/outputField.

Example: If a user does not have write permission for a field, that field will be shown as read only in edit mode in VF page.

Record Access:

A visual force page does not enforces OWD or record level access, that is the job of the controller.

If you are using a custom controller without sharing model, Record level access will not be enforced however FLS and CRUD will be enforced if you use inputField and outputField.

Please refer this link for more details

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .