I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check it in code or can i skip it?
1 Answer
If you're using a Visualforce page and a standard controller, SFDC automatically checks this for you. In case you're writing custom controllers, you'll have to manually run the CRUD/FLS checks. These are enforced at the visualforce layer, not apex. This is a good blog post that contains some examples as well as a bit of an explanation on how it works and how it can be implemented.
Keep in mind though that FLS for any apex:inputField
will be enforced, regardless whether you have a standard or custom controller.
As per the documentation (and Keith's Answer):
VisualForce will also remove fields for which users do not have FLS visibility when rendering edit pages. Additionally, all apex:inputField tags will be rendered as read-only elements for fields that are set to read-only through FLS. Please note that using other input tags such as apex:inputText or apex:inputTextArea with SObject fields indicate to VisualForce that the fields should not be treated as SObject fields and prevent the platform to automatically enforcing FLS
-
-
-
2Can you clarify a bit more that
apex:inputField
respects FLS settings whatever the controller is? So it is fields that are not being presented (viaapex:inputField
) but are being update by the controller that require the explicit FLS checks.– Keith CJun 13, 2018 at 8:11