4

I have a controller class without sharing. On the VF page I have an apex:detail tag where I've set the subject ID. This causes an insufficient privileges error.

I'm guessing setting the subject ID of the apex:detail causes it to requery the record outside the scope of my without sharing controller. Is that what's going on? Is there any way to force it into without sharing?

UPDATE: this also seems to apply to a chatter:feed tag referencing an record ID even if the controller is without sharing.

Improve this question
3
  • Is the Vf page accessible to user?
    – Mohith Shrivastava
    Commented Jul 23, 2013 at 18:29
  • Yes the user can see the page and the rest of the content fine if I remove the apex:detail tag
    – Phil B
    Commented Jul 23, 2013 at 18:30
  • Then you are right i feel.The Subject Id is troubling you.
    – Mohith Shrivastava
    Commented Jul 23, 2013 at 18:38

1 Answer 1

Reset to default
1

Visualforce and Apex Code are two distinct layers. It's important to remember this. Even a page running "without sharing" in the controller will still respect field level visibility on the page, for example. You can't bypass Visualforce's security, but you can trick it by querying the data in a no-sharing zone and rendering the data in non-apex:outputField/apex:inputField tags.

Improve this answer
2
  • Hm, so how would VF know without some type of controller layer? I assumed for tags like apex:detail it was still utilizing a controller to execute the query it was just part of system code that is not accessible.
    – Phil B
    Commented Oct 4, 2013 at 20:03
  • 1
    Visualforce will use the standard controller for the page, or construct a standard controller from a sobject passed into the detail's subject attribute. In either case, that code is a system library that always runs in user mode (with sharing, field level security, etc, in place). This design helps limit data exposure that would otherwise occur from careless controller design. Reckless design, however, is still not covered.
    – sfdcfox ♦
    Commented Oct 4, 2013 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .