2

I am building a dynamic data table in lightning and trying to enforce object and field level security for it, but I'm having some issues.

Here is my code to check for object access.

String[] objects = new String[]{'Broker__c'};
List<Schema.DescribeSobjectResult> results = Schema.describeSObjects(objects);
boolean objectVisible = results[0].isAccessible();
System.debug('Object visible: ' + objectVisible);

Broker__c would be a String variable but for this example, I hard-coded it. I tested this on a profile that didn't have modify all data or view all data enabled and I turned access to the Broker object completely off. However, when I pull up the data table and look at my debug logs, Object Visible is always true. This only seems to be an issue if the object is dynamic. For instance, using the code below returns the correct boolean value.

boolean objectVisible = Schema.sObjectType.Broker__c.isAccessible();
  • 1
    I'm not sure if this behavior is generically reproducible. Can you try Schema.getGlobalDescribe('Broker__c').getDescribe().isAccessible() and see if it also returns an unexpected result? – Adrian Larson Dec 19 '16 at 17:51
  • Hi Adrian, I used that code snippet, but I get the following error when trying to save the class. "Method does not exist or incorrect signature: Schema.getGlobalDescribe(String)" – user3562811 Dec 19 '16 at 18:43
  • Sorry, Schema.getGlobalDescribe().get('Broker__c')... – Adrian Larson Dec 19 '16 at 18:44
  • I used the code below but now I get the error "Method does not exist or incorrect signature: [Schema.SObjectType].isAccess‌​ible()" boolean objectVisible = Schema.getGlobalDescribe().get('Broker__c').getDescribe().isAccess‌​ible(); – user3562811 Dec 19 '16 at 18:47
  • That seems like the error you would get if you dropped the getDescribe call from that code snippet. – Adrian Larson Dec 19 '16 at 21:39
5

You might try getting the DescribeSObjectResult directly from the global describe and checking against that:

SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c');
Boolean isMyObjectAccessible = sObjectType.getDescribe().isAccessible();

If you want to also check which fields are accessible, you can get them from the fields map.

Set<SObjectField> accessibleFields = new Set<SObjectField>();

SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c');
for (SObjectField field : sObjectType.getDescribe().fields.getMap().values())
    if (field.getDescribe().isAccessible())
        accessibleFields.add(field);
0

Well We have an Amazing library that does FLS and sharing checks for us in APEX which is of enterprise grade. ESAPI. The access control module provides functionality to enforce the Force.com built in access control mechanisms: CRUD, FLS, and Sharing. As described in the apex documentation, apex classes execute in system context and not in the current user context. This is why the platform can't enforce any of the security models. For more details please see Enforcing CRUD and FLS. This ESAPI module allows apex classes execute statements such as insert object; as if operating in user context.

https://github.com/forcedotcom/force-dot-com-esapi

  • Thanks for this Pranay. I will check it out, but why does my code above not work? From all the documentation I've seen from Salesforce, that's how you're supposed to check for object accessibility. – user3562811 Dec 19 '16 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.