I have an org (Dev, Winter 14) where I created a custom report folder and restricted access from my other user. When I log in as that user, he cannot see the custom report folder in the Report tab. However, I wrote the APEX controller and VF Page below, and he can see the folder being returned in the query.

Strangely enough, I can't seem to replicate this on another org. The only oddity I could find for this user is that I'm using a platform license, but there doesn't appear to be any other profile settings set that would give extra access. It mostly seems strange that the security is different in two parts of the application.

APEX Controller:

public with sharing class A_Test
    public List<Folder> stuff {get;set;}

    public A_Test()
        stuff = [SELECT id,name,developername FROM folder WHERE name!='' and developername!='' and type='Report'];

VF Page:

<apex:page controller="A_Test">
    <apex:repeat value="{!stuff}" var="s">
        <apex:outputText value="{!s.Name}"/><br/>
  • What's important for you ? (Non-)access to the folder or to its contents ? Maybe you should run the same query on the folder contents to see if you other user can see inside.
    – altius_rup
    Oct 27, 2013 at 5:58
  • The issue here is that if a VF page is set up to pull Report Folders for a user to view via a query, they are seeing stuff that they should not have access to. Once they get to that folder, they can also see the contents inside. Oct 27, 2013 at 14:15
  • I guess this is because of 'with sharing'. can you try removing it? Nov 11, 2013 at 11:33
  • @Ganesh 'with sharing' is the mechanism that should enforce security. If I remove it, I am at the mercy of other source code deciding on my security level, and at worst am purposely ignoring security (which doesn't solve my problem unfortunately). Nov 12, 2013 at 3:50
  • Opps sorry, just confirmed, 'With Sharing' keyword must be present. My Bad. Nov 12, 2013 at 5:48

2 Answers 2


I think it has something to do with the new(er) report and dashboard folder sharing. I think it was introduced in Summer '13. I couldn't replicate your problem until I enabled this sharing.

enter image description here

enter image description here

Once I enabled this sharing in my dev org, I could login as the user who can't see the report folder in the Reports tab, but he can see it in the Visualforce page. I then disabled the folder sharing and now the test user can't see the folder in the Visualforce page.

  • I tried toggling it on and off (default was off) and I still was able to query for report folders that I shouldn't have access to as that user (based on the UI of the Reports tab). Dec 23, 2013 at 18:21

I ended up opening a case with Salesforce and this is now a known issue. https://success.salesforce.com/issues_view?id=a1p300000008YUq

The security issue only seems to be in the apex/soql context when 'Enable access levels for sharing report and dashboard folders' is enabled. This means that for a current workaround, it is possible to make an api query and get the correct result. I am looking at making this call from the client side with the jsforce library by writing something along the lines of:

<apex:page showHeader="true" sidebar="true">
<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jsforce/1.5.0/jsforce-core.js"></script>

<h1>Api Context: Report Folders user can access</h1>
<h3 id="folder-count"></h3>
<ul id="results">

    var conn = new jsforce.Connection({ accessToken: '{!$API.Session_Id}' });

    conn.query("SELECT Id, Name, DeveloperName FROM Folder WHERE Type = 'Report' AND Name != NULL AND DeveloperName != NULL ORDER BY Name", function(err, result) {
        if (err) { return console.error(err); }
        $('#folder-count').text('Folder Count: ' + result.records.length);

        for (var i=0; i < result.records.length; i++) {
            var folder = result.records[i];
            $('#results').append('<li data-id="' + folder.Id + '">' + folder.Name + ' - ' + folder.DeveloperName + '</li>');

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .