0

I have a visual force page with standard controller (of type standard object) and controller extension.

controller extension for page is of type without sharing.

On this page, I am binding fields from three different custom objects A, B, C through extension.

The profile with which i am accessing page have following accessibility:

  1. Object A - Read, View All
  2. Object B - Read, Create, Edit
  3. Object C - Read, View All

On page on click of one of the command button activity, I am updating record of type B only. But while this activity on visual force page only it is throwing exception

  • messages:system.security.NoAccessException: Create access denied for Object A, controller action methods may not execute
  • system.security.NoAccessException: Update access denied for Object C, controller action methods may not execute

If controller is of type without sharing then why it is still throwing such exception at page level.

Is there any workaround without updating accessibility or any other way. Please help or provide justification.

2

Sharing rules control record level access, the visibility and editability of individual records of an Sobject based on ownership and sharing. with sharing and without sharing affect whether these rules apply to your class.

However, these directives don't affect CRUD and FLS, the object and field level security mechanism on Salesforce. Your code always runs in system mode, ignoring these permissions unless in Execute Anonymous.

You're likely seeing this error (it's hard to be sure without seeing your code) because CRUD and FLS are automatically enforced by the standard controller. To avoid this, your extension can directly perform SOQL and DML, or you can write a custom controller. But best of all, you can allow this permissions enforcements (it's a core part of Salesforce security) and grant the appropriate create and edit permissions to the users of this Visualforce page.

1

If you are using standard controller then it enforces sharing settings on extension controller implicitly regardless what you have given at class level.

Look at the bottom of this documentation: https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_controller_extension.htm

  • That doesn't sound quite right. The documentation linked specifies that the controller extension does execute in system mode. – David Reed Mar 20 '18 at 10:47
  • Copied from doc- look at bottom " ......However, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which the permissions, field-level security, and sharing rules of the current user apply." – Ayub Mar 20 '18 at 19:04
  • 1
    Agreed - the standard controller functionality definitely executes in user mode. I don't read that to mean that user mode is imposed on other controller extension functionality, though. – David Reed Mar 20 '18 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.