2

So I have a standard user, I want to restrict his access to the My_Field__c field. In the permission set which is assigned to him, I have disabled the Read rights of the My_Field__c field.

The field still appears in his UI, it should just be a blank table cell but the value in the field is appearing.

I have the following code in my controller to check if the field is accessible to him and sure enough, it's returning true.

In my controller 

if (Schema.sObjectType.My_Object__c.fields.My_Field__c.isAccessible()){

    System.debug('FIND ME: ' + Schema.sObjectType.My_Object__c.fields.My_Field__c.isAccessible());
}

.

Vf

<apex:outputText value="{!formattedMyField}"/>

I know apex runs in 'system mode' which ignores all field permissions and such at runtime, but what I want to know is if there is a manual way to enfore FLS.

I'm also aware I could just hide the field with some CSS, but if possible, I would like to enfore FLS in my controller somehow.

Cheers!

From the documentation:

 'Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution.'
1
  • Can you post some of your Visualforce to show how you are displaying the field on the page? – Daniel Hoechst Jun 18 '14 at 15:44
4

If your user can see the field in the UI, then that tells me the user still has access to the field. Visualforce obeys field level security and won't display fields the user doesn't have access to.

You said you have disabled read rights in a permission set. I think this is your problem. Permission sets are additive, and can not take away permissions. You need to check the profile assigned to him and take away the field permission there.

Here's an article that describes how FLS is enforced: https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS

Update: The reason FLS isn't being enforced on the Visualforce page is that you are referencing a property of the controller instead of an sObject field. If you referenced it directly, FLS would be enforced.

<apex:outputField value="{!My_Object__c.My_Field__c}"/>
6
  • From the docs: 'Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution.' salesforce.com/us/developer/docs/apexcode/Content/… – Daft Jun 18 '14 at 14:20
  • That's true that Apex runs in system context, but Visualforce uses FLS. I'll add a link to my answer. In your question it sounds like you just don't want to display a field to a user. VF should handle that. – Daniel Hoechst Jun 18 '14 at 14:23
  • So I removed the read permission on the Standard User Profile, and now while the field is still visible in the UI, .isAccessible() is returning false, which is actually where I needed to be, so thanks for that Daniel! But what's the point of removing it from the permission set at all? If you don't mind me asking, seems to have no effect. – Daft Jun 18 '14 at 15:34
  • Turns out the Read rights must be removed from the Profile and the Permission Set in order to have .isAccessible() return false. Field still appears in the UI however... – Daft Jun 18 '14 at 15:41
  • 1
    Permission sets are used to give users additional permissions. The strategy is to give users a profile with very minimal permissions and than add to it with permission sets. – Daniel Hoechst Jun 18 '14 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.