I have an Invoice Object inovice1, A profile sales1.Profile sales1 have no crud permission for invoice1 object not even read. Also OWD for Invoice object is set to private.Still I am able to insert,update,delete the invoice object invoice1 when logged in by sales1 profile in apex class.( without sharing).Grant access using hierarchy is set true but I have removed role from User too.
2
-
Hi @glls, No permissions sets.But , class is in without sharing(editing the question).In with sharing it is giving error as no rows found on that soql.Is there is no restriction if we use without sharing? Even if no permission is there on object still it will allow me to delete any users object?– Pankaj AndhaleMay 9, 2019 at 1:16
-
@glls Yes updated the same.But please help me with this.I have read this on trailhead--The permissions on a record are always evaluated according to a combination of object-level, field-level, and record-level permissions. When object-level permissions conflict with record-level permissions, the most restrictive settings win. But why it is allowing me to delete the object?– Pankaj AndhaleMay 9, 2019 at 1:24
Add a comment
|
1 Answer
It's allowing you to delete it because it's a without sharing class, in which Apex does not enforce sharing permissions. This is correct behaviour. Also recall that object- and field-level permissions are not evaluated in Apex code unless you check them yourself.
In a with sharing class, you said it is giving no rows found on SOQL. This is also correct behaviour because the user has no record-level permission to see it at all.
Is there something specific you are trying to accomlpish here?
-
Thanks @Charles T.But I will get error if I try to access the objects and fields on VF and Lightning components right? May 9, 2019 at 1:39
-
Yes and no - there are various rules for what does/doesn't work in VF and Lightning for objects/fields you don't have permissions for. For example Lightning Data Service won't pull fields or records you can't see. May 9, 2019 at 1:57