Onclick javascript button - how to enable and disable based on profiles

Question

Onclick javascript button - how to enable and disable based on profiles. For example the button should be displayed based on no of days created , if more than five weeks the button should be visible for all users else it should be visible for only users with profile system administrator

{!REQUIRESCRIPT("/soap/ajax/16.0/connection.js")} 
{!REQUIRESCRIPT("/soap/ajax/16.0/apex.js")} 

var needs = "{!Entry__c.Needs__c}"; 
var removal = "{!Entry__c.Removal__c})"; 
var Id = "{!Entry__c.Id}"; 
var callback = { 
onSuccess: function(decompileResult){ 
window.location = '/{!Entry__c.WeekId__c}'; 
}, 
onFailure: function(decompileResult){ 
alert('Delete Action Failed: ' + decompileResult); 
} 
}; 
if(needs == 'No'||(needs == 'Yes' && removal !=')')) 
{ 
//alert('Please Enter a Authoriser and Unavailability Notes'); 
window.parent.location.replace('/apex/DiaryEntryEditPage?retURL='+diarId+'&Id='+diarId+'&r=r&needsReason=No'); 
} 

else{ 

//alert('Please Enter a Amendment Reason and Unavailability Notes'); 

window.parent.location.replace('/apex/DiaryEntryEditPage?retURL='+diarId+'&Id='+diarId+'&r=r&needsReason=Yes'); 
}

Answer 1

I'm not sure if you can actually hide the button based on the current user profile if you are using a simple page layout unless you have an embedded Visualforce page that would allow you to do it using Javascript.

But for sure you should be able to change the button behaviour by checking the current user profile with something similar to this:

if ("{!$Profile.Name}" === "System Administrator") {
  // Your code
}

For example you could display an error message if the user clicks on the button and X number of days haven't passed and the current user profile is not a System Administrator.

Another possible solution would be to use different page layouts for different profiles / record types combinations.

You could create the record with a record type that has a page layout assigned that doesn't display the button and after X amount of days you could change automatically the record type to one that has a page layout assigned that does display the button.

System Administrators could have the same page layout, the one that does display the buttons, assigned to them for both record types.

Clearly this does has a higher maintenance cost since you end up with two separate page layouts that you need to keep in sync, besides needing the additional record type.

Answer 2

In situations like this I tend to avoid putting the show/hide logic in Javascript since it's easy enough to modify in the browser to bypass a security check (you can simply redefine the onClick function in the browser console and click!). I know security may not be a top priority here, but there may be another solution that also makes your code cleaner. Based on the sample code, I'm assuming this is being deployed in a Visualforce page (a similar approach could be taken in Lightning, however), you can try using an apex:outputPanel to hide/show your content:

...
<div> I may or may not show a button here!</div>
<apex:outputPanel layout="none" rendered="{!IF(recordCreated > 5 || $Profile.Name == 'System Administrator')}">
    <button onclick="">Do the right thing!</button>
</apex:outputPanel>
...

I use layout="none" so that no HTML markup gets generated by the outputPanel itself.

I'm using $Profile.Name, though in most other circumstances I'd recommend $Profile.Id in case the name ever changes, no matter how unlikely.

Your Javascript onClick function now only has to deal with the alert and browser redirect, the rendered attribute will make sure the button only shows up when it's supposed to.