0

I am not clear with below two concepts - are both actually same?

Standard Controller with Extension

Although a controller extension class executes in system mode, if a controller extension extends a standard controller, the logic from the standard controller does not execute in system mode. Instead, it executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply.

With Sharing

Use the with sharing keyword when declaring a class to enforce sharing rules of the current user. Explicitly setting this keyword ensures that Apex code runs in the current user context.

The only difference I see in "Standard Controller with Extension" is, this also runs in User context, but ensure User Permissions and FLS are enforced.. Whereas, with sharing only enforce sharing settings of the User and doesn't care about Object access or FLS of the user..

Is my understanding correct? kindly help!

4
  • does you controller extension actually extend a standard controller? This is a pretty unusual pattern. 99% of controller extensions do not extend standard controllers
    – cropredy
    Sep 19, 2021 at 5:19
  • I haven't implemented a controller and just wanted to understand the difference for knowledge purpose.
    – Vignesh L
    Sep 20, 2021 at 16:10
  • with sharing only affects record viz, not FLS
    – cropredy
    Sep 20, 2021 at 17:10
  • So, Standard Controller with Extension obeys record sharing, and also FLS.. Am I right?
    – Vignesh L
    Sep 22, 2021 at 21:59

1 Answer 1

0

A controller extension (that extends a standard controller) will look lke this in Apex:

public class MyControllerExtension {
  public MyControllerExtension(ApexPages.StandardController ctrl) {..}
  public PageReference actionMethod1() {..}
  public void actionMethod2() {..}
}

and in a VF page as

<apex:page standardController="Contact" extensions="MyControllerExtension">
.. markup
</apex:page>

If either the VF page includes an action of the form:

action="{!save}"  // or any of the other standard controller actions 

OR

the controller extension uses apex of the form

this.ctrl.save(); // or any of the other standard controller actions

THEN per the VF doc you cited

those actions will:

executes in user mode, in which permissions, field-level security, and sharing rules of the current user apply.

but if the controller extension does its own querying or DML within its action methods or getters, then that logic executes in system context and you are responsible for FLS.

Sharing mode on the class definition will determine record visibility in queries

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.