Customer portal high volume portal users record sharing help

Question

As i know, customer portal user with high volume volume portal user license users only have record access through sharing sets which will only shows a related object records with their own contact or account. But my requirement is to give access to records of organisation other records which is linked to other portal users (all custom object, std object records).

Record sharing from other ways to these license types not allowed, As i checked in blogs. But i don't want go with customer portal manager or custom licenses for archiving record sharing with roles or other apex managed sharing, as these all r costlier.

Is it possible to archiving this requirement in high volume portal user licenses in any ways?

As per my view, Through visual force page and "Without sharing" keyword will display records irrespective of sharing model.

But are these users are allowed to edit records through this visual force pages on which he actually don,t have access? Please help on this?

Answer 1

When you remove with sharing for a class then you can also do a DML irrespective of you have the permission or not .

Dan's post that may help you further understand, "Without Sharing: Best practices when bypassing Apex sharing rules and object security" - alternatively you can create wrapper classes also to get data even though Users don't have access to records

Updated in response to your comments below:

Scenario 1: Suppose if the portal user have read and edit access in standard/custom objects field-level-security, and all. But record is not shared with them. then we don't need to use wrapper classed to display in VF page or still we wrapper to show?

You will be able to query those records only if your class is without sharing .

Scenario :2 Suppose one of my Salesforce user is updating my custom object, which will usually will update the parent object field (don't have access in fls level) then, doing this updation through trigger will really update the parent object field or not? (whether sharing is enforced or not in triggers)

If you don't have FLS again trigger will run in withoutsharing context and trigger should update parent field

Scenario 3: Is there any difference in std controller VF page and custom VF page UI in showing records on which they dont have sharing access, but object and field-level-security level access is there?

If you use standardcontroller object permissions will apply and hence would suggest you to build complete custom controller with "without sharing" keyword.