Force.com Site: Read access denied for Custom_Object__c, but works fine in sandbox

Question

I have a basic visualforce page that uses the standard controller for an object (Custom_Object__c). The object is a detail record, with the master being another custom object (Parent_Object__c).

The page simply shows a handful of read-only fields. The page is exposed via a Force.com site.

This is working fine in the sandbox. But in production, the page is logging this error: System.VisualforceException: Read access denied for Custom_Object__c, controller action methods may not execute

I've given the site Guest user Read access to both the child and parent object. I've also created a sharing rule that gives the Guest read-only access to all parent objects, just in case. But no luck. I've also confirmed that the visualforce page has been added as an authorized page in the Site settings.

Normally, I'd assume the Guest user can't use a standard controller after the Summer 20 security changes. But if so, why would this be working fine in the sandbox?

I'm currently comparing security settings between the sandbox and production. I see that "Secure guest user record access" is checked in both environments. Any other ideas?

Answer 1

I ended up using a custom controller instead of a standard controller. Even then, it wasn't working. I finally had to work around Field Level Security by creating variables and putting the field values into them.

//doesn't work, even if granted field access:
{!Custom_Object__c.Some_Field__c}


//Workaround in controller:
public string someField = Custom_Object__c.Some_Field__c;
//workaround in page:
{!someField}

I'm sure this isn't the best solution. But it's a read-only page and it's the only thing I could get to work. I tried everything else: object access, FLS, sharing rules, debug logs, PageMessages, site settings, etc.

The strangest part is that this was working in the sandbox...