Timeline for VF controller system context versus Sites Guest User object permissions
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 18, 2013 at 3:16 | comment | added | jkraybill | I think you're asking if it's allowed to create Apex code that doesn't manually enforce FLS and CRUD for every operation, if you're not distributing via AppExchange? The answer is definitely yes, and pretty much every installation of SFDC I've ever seen with custom code does this since a large amount of the time FLS / CRUD permissions are not relevant to what a piece of code must do - i.e. if the customer is creating an operation that they know all users need, enforcing CRUD/FLS is overkill. | |
| Jan 8, 2013 at 13:03 | comment | added | Peter Knolle | This is how I interpreted it as well. Would you say that it is acceptable to perform the CRUD actions in Apex as long as you don't ever wish to distribute it over the AppExchange (i.e., aren't concerned about the security review)? That is, it doesn't violate the user licensing terms? There was an answer to a similar question that made some other points. | |
| Jan 8, 2013 at 5:30 | history | answered | jkraybill | CC BY-SA 3.0 |