Why does apex with sharing allow updates to a read only object?

Question

It appears that Visualforce with Apex is behaving different than native Salesforce pages with regards to sharing.

• I have a custom object Test Object with an Org-wide Default of "Private"
• I have a Visualforce page with a custom controller running with sharing.
• I have a profile called Test Profile that only has Read on the Test Object
• The controller gets the id of the record from the url and fetches the Test Object record
• There's an <apex:inputField /> on the page that is bound to the object's Name field.
• There's a <apex:commandButton /> with an action that simply does an update on the record
• There is a Sharing Rule that shares the Test Object with the user in the Test Profile providing Read/Write to the record

So, based on what I'm seeing in the documentation, I would expect the user to not be able to edit the record that is shared with them as Read/Write because their profile only has Read on the object level permission. This is the case if you browse to the native Salesforce page (/{id of record}). This page does not have an edit button making it so I cannot make any changes.

However, if I go to my visualforce page and click the <apex:commandButton /> which does a simple update testObject;, it will successfully save the record.

So, why does an apex class with sharing appear to behave differently than a native Salesforce page? Shouldn't I get a DML error about insufficient privileges or something?

Answer 1

Like other Apex classes,triggers, all custom controllers run in system mode. Consequently, the current user's credentials are not used to execute controller logic, and the user's permissions and field-level security do not apply.

Apprently you could explicitly check if the record is editable by user using the below code

String objName = 'Account';
Boolean isUpdateableAccount =      Schema.getGlobalDescribe().get(objName).getDescribe().isUpdateable();
System.debug(isUpdateableAccount);

Actually using simple read only Chatter Free license you can edit any standard /custom object in salesforce. It is called as GOD mode abuse.

You can get the details about this here. http://www.jitendrazaa.com/blog/salesforce/system-mode-or-god-mode-in-apex-gotchas/