0

I have few question on "with Sharing" and "without Sharing" keyword in apex,

In my Org the OWD for case is Public read only. I have one class where i am updating owner id of the case to some hard coded user id. The running user doesn't have edit access to that case and the class is running in "with sharing" mode but still he is able to update the owner of that case with that hard-coded user Id but when i am updating any other field along with owner id then the code is giving exception "insufficient Access on cross reference entity". The running user profile doesn't have "transfer records", "transfer Cases", "Modify All Data" and not even "Modify All" on Case object. I tried checking UserRecordAccess table and i am getting only read access to that record for the running user and even no Implicit sharing as well. Attaching the screenshot for your reference.

Can someone please help me here : Did anyone face this issue before ?? Is my assumption correct that with sharing class doesn't check the access if we update only "ownerId" for that record ??

Thanks in advance.enter image description here

Improve this question
2

1 Answer 1

Reset to default
0
  • Apex always works in System Context. Even if the user does not have access on the profile or permission set, still will be able to make updates. You can enforce security rules in this way:
if (Schema.sObjectType.Case.isUpdateable()) { //isAccessible(), isCreateable()
    // Update code
}
  • with sharing will enforce OWD rules, and generally should block all updates when the user has read-only access to the record. I am trying to find something about OwnerId.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .