User able to query for Report Folder he can't see

Question

I have an org (Dev, Winter 14) where I created a custom report folder and restricted access from my other user. When I log in as that user, he cannot see the custom report folder in the Report tab. However, I wrote the APEX controller and VF Page below, and he can see the folder being returned in the query.

Strangely enough, I can't seem to replicate this on another org. The only oddity I could find for this user is that I'm using a platform license, but there doesn't appear to be any other profile settings set that would give extra access. It mostly seems strange that the security is different in two parts of the application.

APEX Controller:

public with sharing class A_Test
{
    public List<Folder> stuff {get;set;}

    public A_Test()
    {
        stuff = [SELECT id,name,developername FROM folder WHERE name!='' and developername!='' and type='Report'];
    }
}

VF Page:

<apex:page controller="A_Test">
    <apex:repeat value="{!stuff}" var="s">
        <apex:outputText value="{!s.Name}"/><br/>
    </apex:repeat>
</apex:page>

Answer 1

I think it has something to do with the new(er) report and dashboard folder sharing. I think it was introduced in Summer '13. I couldn't replicate your problem until I enabled this sharing.

Once I enabled this sharing in my dev org, I could login as the user who can't see the report folder in the Reports tab, but he can see it in the Visualforce page. I then disabled the folder sharing and now the test user can't see the folder in the Visualforce page.

Answer 2

I ended up opening a case with Salesforce and this is now a known issue. https://success.salesforce.com/issues_view?id=a1p300000008YUq

The security issue only seems to be in the apex/soql context when 'Enable access levels for sharing report and dashboard folders' is enabled. This means that for a current workaround, it is possible to make an api query and get the correct result. I am looking at making this call from the client side with the jsforce library by writing something along the lines of:

<apex:page showHeader="true" sidebar="true">
<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jsforce/1.5.0/jsforce-core.js"></script>

<h1>Api Context: Report Folders user can access</h1>
<br/>
<h3 id="folder-count"></h3>
<ul id="results">
</ul>

<script>
    var conn = new jsforce.Connection({ accessToken: '{!$API.Session_Id}' });

    conn.query("SELECT Id, Name, DeveloperName FROM Folder WHERE Type = 'Report' AND Name != NULL AND DeveloperName != NULL ORDER BY Name", function(err, result) {
        if (err) { return console.error(err); }
        $('#folder-count').text('Folder Count: ' + result.records.length);

        for (var i=0; i < result.records.length; i++) {
            var folder = result.records[i];
            $('#results').append('<li data-id="' + folder.Id + '">' + folder.Name + ' - ' + folder.DeveloperName + '</li>');
        }
    });
</script>