I would like to allow updates on a field only from the code of a managed package. This happens when the user clicks on Save on the VF page.
I do not want to allow the subscriber org to update this field through custom code.

I would like to restrict this in the trigger.

Any ideas on how this can be achieved? I do not want to use any new field to determine that I am making the updates from a VF page as the field in question itself is to serve that purpose.

  • 3
    Why must it be updated from the page? This may be an x-y problem.
    – sfdcfox
    Jan 24, 2018 at 3:24
  • @sfdcfox, The story is too long but we are running batches that will look at the updates to this field to determine the appropriate action. We don't want the user to update it as it might create a lot of confusion.
    – SF Learner
    Jan 24, 2018 at 4:52

3 Answers 3


AFA I can understand you want to only allow record creation from your custom VF page.

You can handle this in your trigger

if(ApexPages.currentPage() != null && ApexPages.currentPage().getUrl() != null && ApexPages.currentPage().getUrl().contains('Enter Your VF page Name')) {
    // allow record creation
} else  {
   // throw error

So user won't be able to create record from any other place.

  • what if the subscriber creates a vf page with the same name as in the managed package? can this code differentiate? I haven't tried it.
    – SF Learner
    Jan 24, 2018 at 4:34
  • Would this work from a trigger context?
    – SF Learner
    Jan 24, 2018 at 5:14
  • @ShaliniSF Yes in that case you can also add base URL with this. Yes it will work because I have tested this in Trigger. Jan 24, 2018 at 5:24
  • is the code you have written to go in the trigger? I don't want to throw any error to the user. If the user tries to update this field, it should silently die :) without complaining and update other fields but this one. It is straight fwd if I could throw an error which is not the case :(
    – SF Learner
    Jan 24, 2018 at 5:53
  • 1
    this check on ApexPages.currentPage().getUrl() worked! Thank you so much
    – SF Learner
    Feb 23, 2018 at 5:59

I don't know how you could achieve that, but something you could do from a trigger is check whether the user making the change has a license to use the package:

UserInfo.isCurrentUserLicensed('<<package name space here>>');

that way even if they are changing the field from elsewhere they're presumably allowed to. Of course, they may break things if your code relies on that page being the only source of updates for the field.

All that said, I agree with @sfdcfox's comment. I think we need to know more about your problem.

  • We are not restricting the access to the subscriber's profile. They have access to this field, it's just that it is created to serve our own purpose and we don't want the user to meddle with that.
    – SF Learner
    Jan 24, 2018 at 4:47

If you want to validate a field can only be edited from your package, use a public (not global) Boolean flag.

public static Boolean allowFieldEdit = false;

public static void disallowFieldEdit(List<pkg__MyObject__c> records, Map<Id, pkg__MyObject__c> records)
    if (allowFieldEdit) return;
    for (pkg__MyObject__c record : records)
        if (record.Field__c != oldMap.get (record.Id).Field__c)
            record.addError('Some message');

Now anywhere in your package you can just set the flag for a transaction before performing a DML operation.

MyObjectService.allowFieldEdit = true;
// updating the field will now be allowed
// for the remainder of the transaction
  • I don't want to throw an error to the user as he is not even aware of this field.We are overriding the new/edit/view links on the standard page. This check is to restrict the field updates from the code/data loader from within the subscriber's org.
    – SF Learner
    Jan 24, 2018 at 5:09
  • Then revert the value instead.
    – Adrian Larson
    Jan 24, 2018 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .