How user is able to Update Record

Question

I have a custom object whose OWD is Public Read/Write and the profile of user has Read and View All permission for that Object.

Now I have a Custom Button on that Object using Aura component I'm updating the record on click of that button. In the Controller class of Aura Component, I have not used any with sharing or without sharing keyword. There is no permission set assigned to user.

I have a record where the user is not the owner but on click of Custom Button user is able to update the record.

If I change the OWD to Public Read Only, then user is not able to update the record using custom button.

Now based on my understanding, if OWD of object is Public Read/Write then he can update record only when he has edit permission for that object. But here user is able to edit record even though his profile does not have Edit permission. Can anyone explain to me why this is happening?

Answer 1

Field-Level Security and CRUD object permissions are not enforced against your Apex code. You are responsible for ensuring that your code appropriately enforces these layers of the Salesforce security model.

See the older article Enforcing CRUD and FLS for more description of where and how you do this enforcement. Recent releases of Salesforce have added new tools for doing do, such as the Security.stripInaccessible() call and the WITH SECURITY_ENFORCED SOQL clause. However, these tools don't alter the fundamental responsibility to enforce CRUD and FLS explicitly in Apex code.

The enforcement of Organization-Wide Defaults against your code is determined by the sharing model of your class, whether declared or inherited from calling context. Aura controllers default to operate in with sharing context in many orgs after a recent critical update, which appears to apply to your org. It is best practice to always declare a sharing model explicitly, but the sharing model has no effect on FLS enforcement.