10

It appears that Visualforce with Apex is behaving different than native Salesforce pages with regards to sharing.

  • I have a custom object Test Object with an Org-wide Default of "Private"
  • I have a Visualforce page with a custom controller running with sharing.
  • I have a profile called Test Profile that only has Read on the Test Object
  • The controller gets the id of the record from the url and fetches the Test Object record
  • There's an <apex:inputField /> on the page that is bound to the object's Name field.
  • There's a <apex:commandButton /> with an action that simply does an update on the record
  • There is a Sharing Rule that shares the Test Object with the user in the Test Profile providing Read/Write to the record

So, based on what I'm seeing in the documentation, I would expect the user to not be able to edit the record that is shared with them as Read/Write because their profile only has Read on the object level permission. This is the case if you browse to the native Salesforce page (/{id of record}). This page does not have an edit button making it so I cannot make any changes.

However, if I go to my visualforce page and click the <apex:commandButton /> which does a simple update testObject;, it will successfully save the record.

So, why does an apex class with sharing appear to behave differently than a native Salesforce page? Shouldn't I get a DML error about insufficient privileges or something?

1 Answer 1

6

Like other Apex classes,triggers, all custom controllers run in system mode. Consequently, the current user's credentials are not used to execute controller logic, and the user's permissions and field-level security do not apply.

Apprently you could explicitly check if the record is editable by user using the below code

String objName = 'Account';
Boolean isUpdateableAccount =      Schema.getGlobalDescribe().get(objName).getDescribe().isUpdateable();
System.debug(isUpdateableAccount);

Actually using simple read only Chatter Free license you can edit any standard /custom object in salesforce. It is called as GOD mode abuse.

You can get the details about this here. http://www.jitendrazaa.com/blog/salesforce/system-mode-or-god-mode-in-apex-gotchas/

1
  • Thanks. My Apex class is running with sharing, not system mode. The article summarizes exactly what I've posted. However, it doesn't explain why Apex running with sharing is more permissive than the native Salesforce detail page. The apex class is not honoring the profile permissions.
    – fehays
    May 11, 2016 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .