0

I have delete button on the visualforce page. If particular record status moved out of 'Draft' then the record should not be deleted. If user clicks on delete button with the status value 'Open', it should not allow any user to delete the record.

I've already done this in sandbox and pushed to prod. After some days, some users are able to delete the record eventhough the status of the record is moved out of 'Draft'. But if I try to reproduce the problem in sandbox by logging in as a user who deleted the record in production is not able to delete the record.

Then I checked all the security informations(user, profile, permission set, apex code) everything is same as that of in production.

So my question is,

Then how would the user was able to delete the record in Production?.

Also, Is there any way to block any users to delete the record(bypassing everything)?.

  • Can you hide the button based on the RecordStatus? – unidha Apr 21 '17 at 6:58
  • @unidha This is a good idea. We planned to hide the button based on the status field. But I want to know how the users deleted the record in production. – mohammed azarudeen Apr 21 '17 at 7:03
  • @MuzammilBajaria Yes it is custom visualforce page with controller extension – mohammed azarudeen Apr 21 '17 at 7:04
  • Not sure.Is the controller class without sharing? Other way for you to check if user able to delete is using DescribeObject isDeletable() . – unidha Apr 21 '17 at 7:11
  • @unidha The Controller class is with sharing. But sharing rules are same in both sandbox and production – mohammed azarudeen Apr 21 '17 at 7:32
1

Overriding with a Visualforce page only partially protects a record. There are still ways around this UI "protection", such as by using a mobile device, using some sort of tool that uses the API, and so on. What you really need to do is to protect it at the business logic level by implementing a trigger:

trigger preventDelete on Contract (before delete) {
    for(someSObject record: Trigger.old) {
        if(record.Status != 'Draft') {
            record.addError('You may not delete a non-draft contract.');
        }
    }
}

You can build in different logic as needed, such as still allowing administrators to perform deletions, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.