Is there a way to stop an user from seeing an object except when obtained by apex?

Question

I have a community user profile that will have access to a series of visualforce pages, ids will be passed as parameters. Is there a way for the apex pages to be able to get the data for the user while not allowing the user to see the object data through url hacking?

Answer 1

Yes there is. If you get the data using a controller extension, use the without sharing keyword. @sfdcfox wrote an in depth blog post about it.

• Note that if you bind fields using apex:inputField, the page itself will still enforce sharing, so this strategy will just increase read access.
• Note that applying this keyword will turn off sharing for everyone, so you may want to be cautious if the page is enabled for other Profiles.
  • If this is an issue, you can determine which users actually have read access by querying UserRecordAccess. See here.

Answer 2

If the visualforce pages use custom controller, you can make the controller to use without sharing keyword to ensure that the sharing rules for the current user are not enforced. This will make the controller to run in system mode bypassing the user permissions to access the object's records. But they should have read/edit(appropriate) access on the object.

So even if the user doesn't have access to the object's records, they can see those in this visualforce.

Using the with sharing or without sharing Keywords for your reference.

Hope it helps.