1

I have an detail Custom Object that has Contact as its master.

My user profile has Read, but not Edit, Delete or Create permission.

When I login as this user I can View the record, but the Edit and Delete buttons do not appear in the record, whereas they do for administrators. This is expected behaviour.

However, I have a Visualforce page "with sharing" where the user can delete this record. I pass an ID recordToDelete through an actionFunction, and then in the controller do

Database.delete(recordToDelete);

as per the docs.

I would expect an Insufficient Privileges method to be displayed for the user who doesn't have delete permission. However, the data is deleted.

Does Database.delete not respect CRUD permissions?

3
  • Are you using the standard controller with an extension, or just a custom controller? Mar 21 '14 at 17:57
  • The standard controller with an extension. Contact is Public Read/Write
    – George S.
    Mar 21 '14 at 18:02
  • I've just seen the Delete Access part of wiki.developerforce.com/page/Enforcing_CRUD_and_FLS but a) it's not the same object as the standardController, and b) It says CRUD is checked, "Delete is only checked at the object level (CRUD) and not at the field level (FLS)."
    – George S.
    Mar 21 '14 at 18:06
2

Yeah - based on that wiki, I think you need to check for deleteable in the extension before they can delete the record e.g.

public PageReference deleteLead() {
      // Check if the user has delete access on the Lead object
      if (!Lead.sObjectType.getDescribe().isDeletable()){
        ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.FATAL,
                                                    'Insufficient access')); 
        return null;
      }
3
  • Yes, I'm still unsure why the behavior is occurring but this is definitely the solution, an explicit check.
    – George S.
    Mar 21 '14 at 20:18
  • Really? This seems very odd to me that this is required.
    – Phil B
    Mar 21 '14 at 20:33
  • 1
    Agreed - but there was recently a heads up for ISVs that if you are not using the Standard Controller, you MUST explicitly check FLS and CRUD in your code before performing any DML, or you will fail security review. Mar 21 '14 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.