7

A->B are two objects connected using lookup relationships. If somehow, I get read only access to child record but do not have access on parent record then still i am able to see data from parent record through formula fields. Similarly will SOQL in Apex also allow me to fetch fields from parent record regardless of using 'WITH Sharing ' keyword at class level?

2 Answers 2

10

An interesting question that spiked my curiosity.

I did few tests to analyse this behaviour. I created a Parent Object and Child Object. OWD is private for both.

On child Object I created a lookup to parent. I also created a custom field on Parent and named it as "Parent Custom field".

For a custom profile which has C/R/E/D access to both objects, I only shared child record with that profile's user.

Lets analyse it in two aspects, standard aspect and custom code aspect.

1. Standard Aspect :

A) I logged in as the custom profile user and tried accessing Parent record. So here is what I see. I can see Parent's lookup field is populated and clickable. enter image description here

B) After clicking that Parent record, here is what I get. (Do not have acesss, thats a shame.) But I could see the name of the record. enter image description here

2. Custom code Aspect:

I created a custom lightning component, for child record. I made controller as with sharing and used querry that would allow me to access child as well as parents fields I put that component on child's page layout, and checked output.

    public with sharing class ChildParentController {

    @Auraenabled
    public static String getChildWithParent(String childId){
        return JSOn.serializePretty([Select id,name,Aparent__r.Name,Aparent__r.Parent_Custom_field__c,Aparent__r.CreatedDate from Achild__C where Id=:childId]); 
    }
}

enter image description here

If you notice, I have queried for Parent's Name, Parent_Custom_field__c, and CreatedDate. But could only see the NAME in my returned JSON.

Which does make sense, even standard SF UI only allowed us to view the only Name. Making it as without sharing allows me to view all field in the parent, but that's what without sharing is for.

So to answer Does SOQL inner join not respect OWD /sharing settings?:

Yes they do. Syntactically you can write querries that fetches parent's field, but they wont have any data other than parents' Name and Id.

Edit:

For cross-object formula salesforce has added a note

NOTE: If you create a formula that references a field on another object and display that formula in your page layout, users can see the field on the object even if they don’t have access to that object record. For example, if you create a formula field on the Case object that references an account field, and display that formula field in the case page layout, users can see this field even if they don’t have access to the account record.

Which for me, it makes sense, Salesforce gives you an impression that cross-object formula field exists on the child object. If you have access to that child record, you have access to all its fields, irrespective of where its data fetched from.

Source: https://help.salesforce.com/articleView?id=customize_cross_object.htm&type=5

4
  • Thanks..!! I got to know one of my issue by "Standard Aspect". In that case, my user was able to see lookup field of user with name and mini layout(on hover) with Fields.
    – Ysr Shk
    Jun 28, 2018 at 16:42
  • Record Name, Id and system fields are by default Read/visible if you have Object Read permissions regardless of FLS settings. Ditto for RecordType.
    – crmprogdev
    Jun 28, 2018 at 17:54
  • Thank You @Pranay, Did you try cross-object formula field on child object? It seems weird that standard functionality does not work that way. It does show the data from parent record regardless of whether you do not have access on parent record.
    – LakhanP
    Jun 29, 2018 at 7:10
  • @LakhanP I think logically its right, Formula field are considred as normal fields with data. So if user has FLS on that field, he will be able to see it. Edited answer denoting the point. Jun 29, 2018 at 9:17
1

The reason your user is able to see the child record is because of the Formula Field. SOQL doesn't know of the fields that are used to create the formula. It relies on the App Builder to determine what the user should and shouldn't see via formula fields when granting permissions.

A SOQL query from child to parent where the user did not have read access would not return results on the parent for a user that does not have permission to view parent records in a class declared "With Sharing". That's exactly what that keyword is supposed to do: enforce those sharing restrictions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .