I have Opportunity OWD set to Private.

Have over ridden the NEW,EDit,View and Clone buttons of Opportunity with VF page.

I created opp record with USER1.

Logged in as USER2 and still able to see the Opp record(which is a VF page).

Does assigning VF page to buttons violate the OWD..??

Thanks in advance..!!

  • Is there a custom controller behind the page? If so, you sure it has "with sharing" in it's declaration? – rael_kid May 17 '16 at 14:03
  • Hey, I have Opp OWD set to private. i am sending an email on Opp creation to certain set of Users. Say user1 created Opp and mail is sent to User1,user2,User3. I want all 3 users to be able to view the record when clicked on link. – Laxman May 17 '16 at 15:11

Objects and field access:

A visual force page will enforce FLS and CRUD if the fields are binded as sObject fields using input/outputField.

Example: If a user does not have write permission for a field, that field will be shown as read only in edit mode in VF page.

Record Access:

A visual force page does not enforces OWD or record level access, that is the job of the controller.

If you are using a custom controller without sharing model, Record level access will not be enforced however FLS and CRUD will be enforced if you use inputField and outputField.

Please refer this link for more details

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.