Timeline for Must Lightning Data Service always respect running user's object/field access?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 31, 2018 at 20:04 | comment | added | krigi | Thank you @Kevin Venkiteswaran for confirming. I would like to see the Lightning Data Service docs updated to better reflect your comments. Perhaps "Lightning Data Service handles sharing rules and field-level security for you" becomes something like "Lightning Data Service handles sharing rules and field-level security for you, these are always enforced". | |
| Jan 24, 2018 at 5:28 | comment | added | Kevin Venkiteswaran | I can confirm that Lightning Data Service always applies sharing and field level security. There is intentionally no way around this because it'd create a security issue. If you need to access metadata or data without user-level security applied you must do so in Apex because it runs in system mode. Refer to Apex documentation for the various security modes/contexts (eg with vs without sharing). | |
| Jan 23, 2018 at 19:24 | vote | accept | krigi | ||
| Jan 23, 2018 at 19:23 | comment | added | krigi | thank you for providing the link for other readers. I did see that, but as it is written I did not take "...Lightning Data Service handles sharing rules and field-level security for you..." to mean "Lightning Data Service must always respect the running user's object/field access". However, I do understand the inference you are drawing and I think its a valid one to make. Seems like there is no way around this, no "toggle"... Lightning Data Service just works this way by design. | |
| Jan 23, 2018 at 9:51 | history | answered | Aidan | CC BY-SA 3.0 |