Skip to main content
Salesforce

Return to Question

Tweeted twitter.com/#!/StackSalesforce/status/288461481530494976
remove signature
Source Link
edit approved Jan 8, 2013 at 1:45
Ryan Guest
edit approved Jan 8, 2013 at 1:45
Ryan Guest
  • 3.4k
  • 1
  • 23
  • 36

I'm trying to clarify VF controller context versus Sites Guest User permissions on Contact record.

From everything I've read, a VF controller using "without sharing" operates in the system context. Does this mean a VF page on a Force.com Site essentially has full CRUD permissions on the Contact object, for example?

If so, why does the Guest User profile allow only Read/Create permissions (through Public Access Settings) on the Contact record? It seems like the only reason I need to set Read permissions for Guest User is if I am referencing an object's fields on the page using inputField. Otherwise, selects and DML in the controller are in system context and thus ignore the profile's object permissions. Is that correct?

thanks david

I'm trying to clarify VF controller context versus Sites Guest User permissions on Contact record.

From everything I've read, a VF controller using "without sharing" operates in the system context. Does this mean a VF page on a Force.com Site essentially has full CRUD permissions on the Contact object, for example?

If so, why does the Guest User profile allow only Read/Create permissions (through Public Access Settings) on the Contact record? It seems like the only reason I need to set Read permissions for Guest User is if I am referencing an object's fields on the page using inputField. Otherwise, selects and DML in the controller are in system context and thus ignore the profile's object permissions. Is that correct?

thanks david

I'm trying to clarify VF controller context versus Sites Guest User permissions on Contact record.

From everything I've read, a VF controller using "without sharing" operates in the system context. Does this mean a VF page on a Force.com Site essentially has full CRUD permissions on the Contact object, for example?

If so, why does the Guest User profile allow only Read/Create permissions (through Public Access Settings) on the Contact record? It seems like the only reason I need to set Read permissions for Guest User is if I am referencing an object's fields on the page using inputField. Otherwise, selects and DML in the controller are in system context and thus ignore the profile's object permissions. Is that correct?

Source Link
David
David
  • 405
  • 1
  • 3
  • 10

VF controller system context versus Sites Guest User object permissions

I'm trying to clarify VF controller context versus Sites Guest User permissions on Contact record.

From everything I've read, a VF controller using "without sharing" operates in the system context. Does this mean a VF page on a Force.com Site essentially has full CRUD permissions on the Contact object, for example?

If so, why does the Guest User profile allow only Read/Create permissions (through Public Access Settings) on the Contact record? It seems like the only reason I need to set Read permissions for Guest User is if I am referencing an object's fields on the page using inputField. Otherwise, selects and DML in the controller are in system context and thus ignore the profile's object permissions. Is that correct?

thanks david