I have an detail Custom Object that has Contact as its master.
My user profile has Read, but not Edit, Delete or Create permission.
When I login as this user I can View the record, but the Edit and Delete buttons do not appear in the record, whereas they do for administrators. This is expected behaviour.
However, I have a Visualforce page "with sharing" where the user can delete this record. I pass an ID
recordToDelete through an
actionFunction, and then in the controller do
as per the docs.
I would expect an Insufficient Privileges method to be displayed for the user who doesn't have delete permission. However, the data is deleted.
Does Database.delete not respect CRUD permissions?