0

We use batchable Apex and we use 2 custom objects to process a CSV with some records and then insert them or update them as Account records. So, i give permissions to the user's profile that runs this job on Account object to have read,create, and edit access on Account object. However, i don't want this user to view Accounts so in this profile i select tab hidden on Account object. Although i do not see the account tab, i still have access to accounts. For example, if i copy-paste the link of an account record like (https://MYDOMAIN.lightning.force.com/lightning/r/Account/0011l00000Z5YSGFA3/view), i have access to the record and i can modify it. What is the best way to handle such situations ?

Improve this question

1 Answer 1

Reset to default
3

Depending on your use case, you can probably just turn off CRUD permission for Accounts. Apex can run in "system mode", where it ignores normal security (field, object, and record security). Simply specify "without sharing" in your class' definition (e.g. public without sharing class CsvBatch implements Database.Batchable<String>). You can still choose to enforce sharing on a case-by-case basis using UserRecordAccess, describe calls, etc.

Improve this answer
2
  • thank you very much man! Can i ask you one more question please: If i do not define in my Apex Class with/without sharing, which are the default sharing settings that will be enforced ?
    – Giorgos Galaios
    Commented Mar 6, 2020 at 14:43
  • 1
    @GiorgosGalaios generally, it behaves as without sharing. See salesforce.stackexchange.com/q/16121/2984 for my rather long answer on the subject.
    – sfdcfox ♦
    Commented Mar 6, 2020 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .