2

I am building a dynamic data table in lightning and trying to enforce object and field level security for it, but I'm having some issues.

Here is my code to check for object access.

String[] objects = new String[]{'Broker__c'};
List<Schema.DescribeSobjectResult> results = Schema.describeSObjects(objects);
boolean objectVisible = results[0].isAccessible();
System.debug('Object visible: ' + objectVisible);

Broker__c would be a String variable but for this example, I hard-coded it. I tested this on a profile that didn't have modify all data or view all data enabled and I turned access to the Broker object completely off. However, when I pull up the data table and look at my debug logs, Object Visible is always true. This only seems to be an issue if the object is dynamic. For instance, using the code below returns the correct boolean value.

boolean objectVisible = Schema.sObjectType.Broker__c.isAccessible();
8
  • 1
    I'm not sure if this behavior is generically reproducible. Can you try Schema.getGlobalDescribe('Broker__c').getDescribe().isAccessible() and see if it also returns an unexpected result?
    – Adrian Larson
    Dec 19, 2016 at 17:51
  • Hi Adrian, I used that code snippet, but I get the following error when trying to save the class. "Method does not exist or incorrect signature: Schema.getGlobalDescribe(String)" Dec 19, 2016 at 18:43
  • Sorry, Schema.getGlobalDescribe().get('Broker__c')...
    – Adrian Larson
    Dec 19, 2016 at 18:44
  • I used the code below but now I get the error "Method does not exist or incorrect signature: [Schema.SObjectType].isAccess‌​ible()" boolean objectVisible = Schema.getGlobalDescribe().get('Broker__c').getDescribe().isAccess‌​ible(); Dec 19, 2016 at 18:47
  • That seems like the error you would get if you dropped the getDescribe call from that code snippet.
    – Adrian Larson
    Dec 19, 2016 at 21:39

2 Answers 2

5

You might try getting the DescribeSObjectResult directly from the global describe and checking against that:

SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c');
Boolean isMyObjectAccessible = sObjectType.getDescribe().isAccessible();

If you want to also check which fields are accessible, you can get them from the fields map.

Set<SObjectField> accessibleFields = new Set<SObjectField>();

SObjectType sObjectType = Schema.getGlobalDescribe().get('MyObject__c');
for (SObjectField field : sObjectType.getDescribe().fields.getMap().values())
    if (field.getDescribe().isAccessible())
        accessibleFields.add(field);
0
0

Well We have an Amazing library that does FLS and sharing checks for us in APEX which is of enterprise grade. ESAPI. The access control module provides functionality to enforce the Force.com built in access control mechanisms: CRUD, FLS, and Sharing. As described in the apex documentation, apex classes execute in system context and not in the current user context. This is why the platform can't enforce any of the security models. For more details please see Enforcing CRUD and FLS. This ESAPI module allows apex classes execute statements such as insert object; as if operating in user context.

https://github.com/forcedotcom/force-dot-com-esapi

1
  • Thanks for this Pranay. I will check it out, but why does my code above not work? From all the documentation I've seen from Salesforce, that's how you're supposed to check for object accessibility. Dec 19, 2016 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .