I have a user associated to a profile which does not even have the READ permission on the customObject__c. Now I have to display the customObject__c details on a VF page for this user. I used only a customController to avoid the VF honoring the FLS and Object-Level-Permissions. But I had no luck displaying the data on the VF apart from creating a inner class and displaying the data from there.

Why would the data not display if I am using a custom controller?
Why is the VF honoring the Object level permission even when I am not binding it to any VF tags like <apex:outputField> or <apex:outputText>?

<apex:page controller="customController" >
   the name is {!custClass.name} // This displays the result
   the name is {!custClass.Obj.Name} // THis is blank
   the name is {!customObj.Name} //This is blank

public without sharing class customController{

    public customObject__c customObj{get;set;}
    public custClass custClass{get;set;}

    public customController(){
          customObj = [select name from custom_object__c limit 1];
           custClass = new custClass(customObj);


    public without sharing class custClass{
        public customObject__c obj{get;set;}
        public string name{get;set;}
        public custClass(customObject__c objt){
            this.obj = objt;
            this.name = objt.name;

As far as I can tell, while its not being made very clear in the documentation, i have reproduced and read in this wiki article 'Encorcing CRUD and FLS' that resolving the bindings themselves in the Visualforce page markup is driven by FLS rules regardless of the type of controller, see the section 'Automatic CRUD and FLS Enforcement in VisualForce'.

When rendering VisualForce pages, the platform will automatically enforce CRUD and FLS when the developer references SObjects and SObject fields directly in the VisualForce page.

If you take a look at the following example related to the statement above, it does not use any VF components just simply emits directly the values using an inline binding. Even in this case VF honours FLS when resolving bindings.

<apex:page standardController="Account">
  <apex:pageBlock title="Contacts">
    <apex:dataTable value="{!account.Contacts}" var="contact" cellPadding="4" border="1">
        <apex:facet name="header">Name</apex:facet>
        <apex:facet name="header">Phone</apex:facet>

It goes on to say this...

There are often cases where developers use VisualForce to display data derived from an SObject field in an indirect or processed form. For instance, a page controller may use internal logic to determine the appropriate value to display.

Meaning that as you've discovered, by going via an Apex binding you denny the VF engine the metadata it needs to make the decision regarding the FLS. As the code sample below the above snipped illustrates it leaves the developer to perform the FLS check.

So while I'd be personally happier with a reference in the Visualforce Developers Guide, this Force.com Developer Wiki page does seem to give a reasonable confirmation about the behaviour your seeing. This answer also asks a similar question as well btw Field level Security in VisualForce page

Hope this helps.

  • But the wiki also goes on to say Please note that using other input tags such as apex:inputText or apex:inputTextArea with SObject fields indicate to VisualForce that the fields should not be treated as SObject fields and prevent the platform to automatically enforcing FLS. which is not at all happening. That is where I was a little confused. – Sam Jan 16 '14 at 5:45
  • Yeah good point, i suspect at some point VF bindings have become FLS controlled, such that the bindings giving to those components are not resolved and thus the components are not rendered, this seemed to be the case and finding from the other answer i referenced as well. – Andrew Fawcett Jan 16 '14 at 5:51
  • So displaying the details by storing it in a inner class and then displaying seems to be the only solution. Thanks Andrew for the help! – Sam Jan 16 '14 at 5:55
  • I've always expected that if I directly bind to the sObject (ex: {!Contact.FirstName}) the Visualforce page will enforce FLS; even if using inputText. Still, @TheGreatDanton has a very good point about what the Wiki says. Clearly it's not working as expected there. When working around object, field level, or sharing security on data, I will typically create public vars in my controller. That's rare, but occasionally I like to force users onto a VF page for specific data edits. – Force2b_Mike Jan 16 '14 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.