I have created a custom upload component based on this but using ContentVersion rather than Attachment.

This custom upload component is being used on a public community page and has an Apex controller defined as:

public without sharing class FileUploadController

I am creating a ContentVersion like this:

public static Id saveTheFile(Id parentId, String fileName, String base64Data, String contentType) { 

    try {

        base64Data = EncodingUtil.urlDecode(base64Data, 'UTF-8');

        ContentVersion contentVersion = new ContentVersion(
            versionData = EncodingUtil.base64Decode(base64Data),
            title = fileName,
            pathOnClient =  '/' + fileName,
            FirstPublishLocationId = parentId);

        insert contentVersion; 

        return contentVersion.Id;

    } catch (Exception error) {
        throw new AuraHandledException(error.getMessage());

And then subsequently updating the ContentVersion like this:

private static void appendToFile(Id fileId, String base64Data) {

    base64Data = EncodingUtil.urlDecode(base64Data, 'UTF-8');

    ContentVersion contentVersion = [
        SELECT Id, versionData
        FROM ContentVersion
        WHERE Id = :fileId

    String existingBody = EncodingUtil.base64Encode(contentVersion.versionData);

    contentVersion.versionData = EncodingUtil.base64Decode(existingBody + base64Data); 

    update contentVersion;   

The insert works fine, but when I try and update the ContentVersion I get this error:

Update failed. First exception on row 0 with id 0684E000000Qnt1QAC; first error: INSUFFICIENT_ACCESS_OR_READONLY, You do not have the level of access necessary to perform the operation you requested.

The community guest profile has full access to the custom object the ContentVersion.FirstPublishLocationId is being set to.


  1. What is causing this error?
  2. How can I fix it?

1 Answer 1


It's not possible to update and ContentVersion

Therefore, to solve this, I created the upload as an Attachment and appended to the Attachment, then once the upload was completed I created the ContentVersion and deleted the Attachment

  • Did you try this as a non-guest user? I'm doing the exact same thing, based on the same code, same results for an anonymous guest user, but when I run the code as myself, it works as expected. For the guest, I believe the problem might be related to guest user security settings Salesforce has introduced lately or sharing settings on the parent obj? But now I'm going to try your technique, as I can't expose my parent obj (Cases) to guest users.
    – Stephen
    Apr 28, 2020 at 20:42
  • PS - just to clarify my comment: ContentVersion.VersionData should be updatable if you set ContentVersion.IsMajorVersion = false when you are creating it. Still, the guest user problem remains. I used your Attachment approach and now I have things working for guest users, although it seems like Attachment creation is much slower than ContentVersion creation. (Might be the client's org, trigger or other things....) Thank you for sharing your learnings!
    – Stephen
    Apr 28, 2020 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .