1

I have a patient object , related to Account (lookup relationship). Profile 'Standard User' doesn't have CRUD permissions on the patient object. In Account trigger, I call call 'accounthandler.cls' which has 'With Sharing'. On After Insert of account , I create a patient record and associate it to the Account , in the accounthandler.cls For users with 'Standard User' profile, I was expecting patient record won't be created, when they create an account record, since 'With Sharing' is enabled , so class shouldn't have executed in the system context. However, I see patient record is created as well as owned by that user. Any idea, why it would create a patient record?

7

'With sharing' keyword only enforce sharing rules, not CRUD/FLS.

https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_security_sharing_rules.htm

To enforce CRUD/FLS sharing, use 'WITH SECURITY_ENFORCED' in SOQL query and check user permission using isCreateable(), isUpdateable(), etc for DML operation in the code.

https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm

3
  • So if a user doesn't has a CRUD at profile level, how come a record is created through apex? Mar 7 at 12:51
  • Because CRUD permission is not checked, you have to explicitly check it
    – user1228
    Mar 7 at 12:57
  • Apex don't check object or field permissions during DML operations, you need to do it yourself with something like describe calls and then isCreateable(), isUpdateable(), etc. Mar 7 at 14:55
0

Most likely Your Internal Organization-Wide Sharing for Patient Object have is set to Read Only/ReadWrite, try to change it to Private as users can only read and edit their own user record

The second part we will need to check FLS in the Code Check FLS in the Code Patient.Subject.getDescribe().isCreateable()/.isAccessible()

https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_data_sharing.htm

Difference between isCreateable and isUpdatable for DescribeFieldResult?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.