1

I have an detail Custom Object that has Contact as its master.

My user profile has Read, but not Edit, Delete or Create permission.

When I login as this user I can View the record, but the Edit and Delete buttons do not appear in the record, whereas they do for administrators. This is expected behaviour.

However, I have a Visualforce page "with sharing" where the user can delete this record. I pass an ID recordToDelete through an actionFunction, and then in the controller do

Database.delete(recordToDelete);

as per the docs.

I would expect an Insufficient Privileges method to be displayed for the user who doesn't have delete permission. However, the data is deleted.

Does Database.delete not respect CRUD permissions?

Improve this question
3
  • Are you using the standard controller with an extension, or just a custom controller?
    – BritishBoyinDC
    Commented Mar 21, 2014 at 17:57
  • The standard controller with an extension. Contact is Public Read/Write
    – George S.
    Commented Mar 21, 2014 at 18:02
  • I've just seen the Delete Access part of wiki.developerforce.com/page/Enforcing_CRUD_and_FLS but a) it's not the same object as the standardController, and b) It says CRUD is checked, "Delete is only checked at the object level (CRUD) and not at the field level (FLS)."
    – George S.
    Commented Mar 21, 2014 at 18:06

1 Answer 1

Reset to default
3

Yeah - based on that wiki, I think you need to check for deleteable in the extension before they can delete the record e.g.

public PageReference deleteLead() {
      // Check if the user has delete access on the Lead object
      if (!Lead.sObjectType.getDescribe().isDeletable()){
        ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                                    'Insufficient access')); 
        return null;
      }
Improve this answer
3
  • Yes, I'm still unsure why the behavior is occurring but this is definitely the solution, an explicit check.
    – George S.
    Commented Mar 21, 2014 at 20:18
  • Really? This seems very odd to me that this is required.
    – Phil B
    Commented Mar 21, 2014 at 20:33
  • 1
    Agreed - but there was recently a heads up for ISVs that if you are not using the Standard Controller, you MUST explicitly check FLS and CRUD in your code before performing any DML, or you will fail security review.
    – BritishBoyinDC
    Commented Mar 21, 2014 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .