System.VisualforceException: Update access denied for Contact, controller action methods may not execute

Question

I am having the following error that I haven't seen before:

System.VisualforceException: Update access denied for Contact, controller action methods may not execute

I am using a custom controller.

public without sharing class TestController {
    public Contact myCon {
        get {
            myCon = [SELECT Id, Name, FirstName, MobilePhone FROM Contact WHERE Id =: '003N000000SDkc6'];
            return myCon;
        } 
        set; 
    }

    public TestController() {   }

    public void test(){
        System.debug('@@ ' + JSON.serialize(myCon));
        update myCon;
    }
}

and a Visualforce Page:

<apex:page showHeader="true" sidebar="true" controller="TestController">
    <apex:form>
        <apex:inputText value="{!myCon.MobilePhone}" />
        <apex:commandButton value="save" action="{!test}" />
    </apex:form>
</apex:page>

The page is in a Salesforce site. I know that sites has limitation with editing, but I have similar code in other orgs, and I have been able to update opportunities.

I don't know what I am doing wrong or if there is an extra set up in the site that I am not aware off?

Answer 1

In public access setting of a Force.com site the maximum permissions that you can specify for Contact object are Read and Create. (Edit and Delete are not allowed).

Your page is directly providing edit functionality of Contact record, So you are facing this error. You are binding your contact object directly on page which is leading to problem.

As a workaround you can use code similar to below :

public without sharing class TestController {
    public Contact myCon {get ; set; }
    public String mobNumber {get;set;}
    public TestController() {
        myCon = [SELECT Id, Name, FirstName, MobilePhone FROM Contact WHERE Id =: '003N000000SDkc6'];
    mobNumber=myCon.MobilePhone ;
    }

    public void test(){
        System.debug('@@ ' + JSON.serialize(myCon));
        myCon.MobilePhone=mobNumber ;
        update myCon;
    }
}

On page make changes as:

<apex:page showHeader="true" sidebar="true" controller="TestController">
<apex:form>
    <apex:inputText value="{!mobNumber}" />
    <apex:commandButton value="save" action="{!test}" />
</apex:form>

Answer 2

I was getting a similar error but nothing above resolved it for me. My specific error was:

EXCEPTION_THROWN System.VisualforceException: Update access denied for PricebookEntry, controller action methods may not execute.

Turns out my issue was coming from a unfixable (?) permission issue with the current User Profile and the Related SFDC Object which in my case was "Price Book Entry" (PBE). The solution for me was to update my Apex wrapper class to not use a PBE object.

My code before:

public class PBEItem {
    public PricebookEntry obj { get; set; }
    // I would get name, id and product2 from this PBE      
}

My code after:

public class PBEItem {
     public Product2 product2 {get;set;}
     public String pbeId {get;set;}
     public String pbeName {get;set;}
}

Good luck to anyone else struggling w/this error - was very frustrating - mainly because none of my system.debug() was working no matter how much I fussed w/it! Reference: This article helped get me over the finish line. Good luck!