1

How can I let a Guest User Edit a custom object after this update?

In my scenario, there is VF page with a (Without Sharing controller) trying to edit a record from an inputfield populated by the Guest user but I am getting this error since Winter 21' Release

System.VisualforceException: Update access denied for Developer_Profile__c, controller action methods may not execute.

I was able to give edit access back to guest user profile but I read this will be permanently disable by Spring 21 release So we need to find an alternative solution

1
  • 3
    AFAIK you will have to use a different and logged in user to perform updates. This is a significant breaking change to the platform.
    – Keith C
    Commented Jan 6, 2021 at 14:29

4 Answers 4

2

It should still work if you are using Without Sharing, but it's challenging.

For input fields, you will need to add the new ignoreEditPermissionForRendering attribute on apex:inputField. This will allow you to override entity the lack of edit permission for the guest user. However, it doesn't always seem to work - e.g. Rich Text can be an issue. But if the DML is using without sharing, then you can still update the record. Note - to initially view the record, it either needs to be shared via the new sharing rules, or exposed as part of the without sharing class.

However, this won't typically work for anything that is not an inputField - anything else like select list or inputtext requires a different approach - either bind to a variable in the controller, and set the corresponding field on save, or clone the object without preserving an id, expose that on the page, and then set the id before save (if that sounds mad, it is, but it does seem to work)

I would also suggest joining the Securing Experience Cloud group on Success since there are several threads where people are trying to tackle these issues, and there are links to resources like this one that talk about different approaches you can use.

0

So I have an idea for this...

Create a new custom object. Let's call it GuestOperations. This object has a single field called Body__c which just holds a lot of text.

We create this record with JSON data in that field, holding a list of objects (similar to using the updateRecord function in an LWC).

We have a process that calls an invocable apex action (which should be in system context) to update the records as found in the JSON.

I've done similar things before, just never needed to go through a Process to avoid permissions.

Please let me know if you see glaring issues. I won't be on Spring '21 until next week to really test it out.

0

Salesforce has posted a solution for the Guest User being able to continue to edit records after the permissions are turned off. Or at least thats what I understood from the article. It requires downloading a managed package and encrypting the data before sending it to salesforce. I haven't had the time to make this change from a lightning component to a visualforce page but would like to collaborate on it with some people and see if we can get a solution.

Article: https://www.learnexperiencecloud.com/s/article/Guest-User-Record-Access-Development-Best-Practices#Pattern1

0

You just need to pass ignoreEditPermissionForRendering="true" then it's working fine. See below syntax:-

<apex:inputfield value="{! Contact.LastName }" ignoreEditPermissionForRendering="true">
1
  • how is this different than BritishBoyInDC's answer?
    – cropredy
    Commented Jul 14, 2022 at 23:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .