1

I have created a junction object[XYZ] with object ABC and Contact as masters. OWD for ABC and Contact is PRIVATE, no sharing rule for both objects. Profile level access does not have View All / Modify All permission at record as well as object level for Contact. Profile level access has View All permission at record level for ABC.

Documentation says:

If the record has two master records in a many-to-many relationship, the user must have read access to both master records.

On object ABC's page layout I've added a related list for Object XYZ. The related list displays all the records even if user does not have permission for Contact object. I have no idea why.

Any work around, so that related list does not display records if user does not have access to one of the parent in my case that is contact.

This is professional edition org, so customization doesn't seem as an option.

Improve this question
2
  • Does the profile has at least Read access on Contact Object?
    – maniac coder
    Commented Aug 27, 2020 at 15:44
  • Yes, profile has read access not View All on Contact
    – Tiny
    Commented Aug 27, 2020 at 15:51

1 Answer 1

Reset to default
0

You are likely running into a side effect of Implicit Sharing: https://developer.salesforce.com/docs/atlas.en-us.draes.meta/draes/draes_object_relationships_implicit_sharing.htm

Basically, the system grants Read access to Master records if the user has child access in some cases. The above link has a table that shows which situations allow Salesforce to give implicit sharing access to the user.

As a basic example, consider a user who is given access to a specific Opportunity or Contact. They can usually see the Account record above it, right?

I hope this helps!

Improve this answer
4
  • Record is not accessible for the user, still visible in related list. If I try to open that master record, its not accessible.
    – Tiny
    Commented Aug 27, 2020 at 17:19
  • Parent implicit sharing: "Read-only access to the parent account for a user with access to a child record". By having access to your junction object, the user gets implicit access to at least view the record name of the parent object. That's my theory, anyway.
    – JimG
    Commented Aug 27, 2020 at 18:22
  • Not sure, is there any work around so that only user's accessible records are displayed in related list?
    – Tiny
    Commented Aug 28, 2020 at 5:38
  • I'm not sure there's a good option with your current data design. If the user can see an XYZ record, they'll have implicit visibility of the master record Contact. I suppose you could investigate changing the relationships to Lookups, but I'm not sure how you'd make a sharing rule that checks whether the two parent records are visible and then shows the parent. Perhaps apex sharing rules?
    – JimG
    Commented Aug 28, 2020 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .