I recently checked my managed package using the Force.com Security chechker (by Checkmarx) and the tool listed a few CRUD and FLS issues in my Controller classes.
Before fixing them I tried to better understand why they are needed and used my pages as different users
- that are unable to write certain objects modified by the page (CRUD)
- that are unable to see certain fields shown on the page (FLS)
I expected the page to just ignore my permission settings but it did not!
The fields without FLS were not shown on the page nor where they read by my SOQL code. The same with CRUD. When the page tried to save a read-only object the trigger reported an exception which nicely displayed in the page messages.
So my question is: Why do I need explicit FLS and CRUD checks if Salesforce seems to perfectly respect the permissions?
<apex:inputField>
and<apex:outputField>
tags will enforce these permissions, but they are not the only way to surface fields.