I have a custom controller page

<apex:page controller="Cust1" tabStyle="Account">
  <apex:form >
  <apex:pageblock title="Hello {!$User.FirstName}">

  You belong to account {!accounti.name}
  Change its name 
  <apex:inputField value="{!accounti.name}"/>
  <apex:commandButton value="Save" action="{!save}"/>


and associated controller class

public class Cust1 {
public Account accounti{get;set;}

public cust1()

Accounti = [select name from account where id = :ApexPages.currentpage().getparameters().get('id')];

public pagereference save()
return null;

When i run this as a user who doesnt have edit permission for account, my input field appears as read only.. My understanding was custom controllers run in 'system-mode' It doesn't respect CRUD/FLS So why is this coming as 'read-only?

1 Answer 1


This Enforcing CRUD and FLS documentation includes the explanation and a work-around (though you lose other features of apex:inputField too):

VisualForce will also remove fields for which users do not have FLS visibility when rendering edit pages. Additionally, all apex:inputField tags will be rendered as read-only elements for fields that are set to read-only through FLS. Please note that using other input tags such as apex:inputText or apex:inputTextArea with SObject fields indicate to VisualForce that the fields should not be treated as SObject fields and prevent the platform to automatically enforcing FLS.

  • so irrespective of whether its standard controller/custom controller(usermode/system mode) if its apex:inputfield or apex:outputfield on page--then FLS/CRUD is enforced?
    – sfdc99999
    May 23, 2014 at 12:06
  • 1
    @sfdc99999 AFAIK yes. Its a (non-optional) feature of the apex:inputField Visualforce tag and presumably also the apex:outputField tag. The behaviour mirrors how layout-based UI works. Its independent of how the data was queried.
    – Keith C
    May 23, 2014 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .