0

I built VisualForce page with form to Insert and update account records, it works like a charm, but when I checked account object permission for guest profile, I found there's no read nor create permission, and I still able to create and update account records, I noticed this issue in winter 19 release.

In case if anyone to try it, first register a domain then create site, and create visualforce page with controller using the following code

 <apex:page controller="test" showHeader="false">
      <apex:form >
       <apex:commandButton action="{!save}" value="Save"/>
      </apex:form>
   </apex:page>

public with sharing class test{

public test(){

}

public void save(){
    Account a = new Account();
    a.Name = 'Test' + Datetime.now().format();
    insert a;

    a.Phone = Datetime.now().format();
    update a;       
  }
}

Without giving permission for guest profile, the guest user will be able to create and update account.

  • Not sure what your question is. By default the guest user has the most restrictive permissions possible, to maintain data integrity in your org. So of course by default many (if not all) objects and fields will not be visible to that user. – AvailableName Feb 3 at 9:30
  • Yes that's what I mean, the user doesn't have permissions, but he still able to create, update, delete records, how?! – user1391482 Feb 3 at 9:35
  • is VF controller with sharing? – kurunve Feb 3 at 11:45
  • @kurunve Yes it's with sharing – user1391482 Feb 3 at 11:45
1

Apex, even Apex declared with sharing, does not automatically enforce CRUD and FLS permissions for you.

CRUD and FLS are automatically enforced in Visualforce when data elements are rendered directly into the page via tags like <apex:inputField> or raw Visualforce expressions like {! Contact.Name }. Visualforce does not enforce CRUD/FLS if you render data via an indirection like a wrapper class or a primitive instance variable (a String, e.g., for a Phone field, rather than an sObject field).

If your Visualforce page used standard <apex:inputField> components bound to sObject fields on an Account instance variable in your controller, you would see Visualforce apply permissions there.

However, since all of the operation is performed in your controller, you need to manually enforce permissions. Salesforce has an in-depth discussion with many examples of how to enforce CRUD and FLS in a Visualforce controller. The "Create Access" example is pertinent to your situation.

To summarize, before performing the action to create an Account and populate its Phone field in your Apex controller, you'd need to check

Schema.sObjectType.Account.fields.Phone.isCreateable()

to ensure the user has the right to perform this action.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.