Locked record editable by any user on VF page during approval process

Question

I have a multi-level approval process which locks the record from editing when it is initially submitted and locks the record as a final approval action (except for current approver and sys admin). We have a visual force page to create the cases.

When I log in as a test user who has no association with the created record which is middle of an approval process, I was unable to edit the record in standard/layout view as expected. However, when I open the record in visual force page, I was able to edit the record even though I'm not the current approver or an admin. He doesn't have modify all permission either. I don't get the 'record is locked' message, it just saves with the changes.

How do I fix it? Wouldn’t the vf page respect approval process locked action.

Answer 1

It seems like your code doesn't respect current user’s permissions. Did you try to add to your cf controller ’with sharing’ keyword to respect permissions while using the vf?

If yes, you can check if the user has permissions and then perform your code.

if (Schema.sObjectType.OBJECTAPINAME.isDeletable()) {

}

Of course that instead isDeletable() you can use isEditable().