0

I have a custom object (Team__c) which is visible using a standard profile - Marketing User. However I have not provided any CRUD permissions on this custom object. I validated this on the Marketing User profile. This object X has some required fields which are visible by default for all standard profiles.

Existing CustomObject : Team__c
    - req field: Name 
User: markUser with profile 'Marketing User'. No other permissions
OWD settings Team__C : Public Read/Write

System.runAs(markUser){
   boolean res = True;
   // this should not return any results since Marketing User profile
   // does not have access to Team__C object
   try {
   Team__c teamObj = [Select name from Team__c];
   } catch(Exception e){
        res = False;
   }
   System.assert(res);
}

I had created the Team__c object a long while back and I might have selected some permissions unintentionally. How do I remove the Team__c's object permissions for the profile?

Edit: I added/removed some information for more clarity.

I see that the OWD settings for Team object is Public Read/Write but the Marketing user profile does not have permissions on this object. Does OWD setting override object permissions?

Improve this question
2
  • You do realize it's system.assertEquals(<expected_value>, <actual_value>), right? You have it reversed... And even if the user didn't have visibility, if the query returned zero rows as written it would throw an exception and you would never hit the assertion in the first place.
    – Adrian Larson ♦
    Commented Mar 16, 2017 at 23:14
  • Yes thanks for correcting that. I did realize that it would throw an exception if there are no rows. But at the time of writing this, I actually had this assert return false since the other case wasn't met. I'll edit it.
    – gerad26
    Commented Mar 16, 2017 at 23:19

1 Answer 1

Reset to default
1

I have not reviewed the edit to the question and it may change the below answer but I am leaving in case the details are relevant to those who come later.

Most likely the OWD Sharing setting is public read or read write. Change it to private.

If the OWD is set to public read or read write then if a record links to it or the user has the ID they will be able to see it.

OWD sets the minimum access level and no profile setting can go below that access. Profiles are meant to GRANT access to the records/object and not remove it. Whenever a profile has no access to a record/object and the user can still see it check the OWD

Additionally, your question is a bit unclear as to what is actually the issue. If you could clarify that would be great. Like how is the user accessing the record, what are the OWD and profile settings, what do you want to happen, what is happening, etc

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .