2

I am creating a button that gives some users the ability to delete opportunities. The big caveat is that they need to be able to delete the opps where the owner is in the same role.

I changed my sharing on the class, so it's public without sharing class OpportunityController however, when the user tries to delete a record owned by someone in the same role, they get insufficient privilages!

Why doesn't without sharing fix this? Also, what's the workaround?

public without sharing class OpportunityController {

    public String oppId;     
    public Opportunity opp;



    public OpportunityController(ApexPages.StandardController controller) {
        this.oppId = ApexPages.currentPage().getParameters().get('id');
        string url = ApexPages.currentPage().getUrl() ;


            this.opp = [select id from opportunity where id = :this.oppId];


    }

    public pageReference custDelete(){
        String kurt = '005a0000007Eg1m'; 
        String boyden = '005a0000008V2et';     
        boolean isSysAdmin = false;
        String sysAdmin = userInfo.getProfileId();

        if ('00e30000000bulF' == sysAdmin.substring(0,15)){
            isSysAdmin = true;
        }
        PageReference p;
        if( userinfo.getuserid()!= kurt && userinfo.getuserid() != boyden && !isSysAdmin){ 
            system.debug('dont delete');
            // insuff priv
            return null;
        }else{
        system.debug('delete');
            p = new pageReference('/'+this.opp.id);
            delete this.opp ;
            return p;
        }

      }
Improve this question
  • Your calls to userInfo.getUserId() will return 18 character IDs which you are comparing against 15 character Ids – cropredy Jul 7 '14 at 16:38
  • yup that did it.... sigh.... – PartOfTheOhana Jul 7 '14 at 17:17
  • Is this the only way to achieve this? I feel like this would be a pain to maintain – EricSSH Jul 7 '14 at 17:29
  • i'll move them to a public group, and query against that. that way I don't have to worry about the user Ids.... in terms of the sysAdmin hard coded id, i'm nor worried about that. – PartOfTheOhana Jul 7 '14 at 17:32
1

From Crop1645

Your calls to userInfo.getUserId() will return 18 character IDs which you are comparing against 15 character Ids

Improve this answer
  • That shouldn't have mattered due to implicit string cast to ID. However, you shouldn't ever manually cast ID values to strings. More to the point, you should cast strings to an ID if you're expecting an ID. This avoids problems and can alert you of errors. – sfdcfox Jul 7 '14 at 18:28
  • i updated the code. Can you elaborate on the problems it can cause? I literally never knew this before! thanks – PartOfTheOhana Jul 7 '14 at 20:17
  • Mostly the type that you ran into-- comparing strings often yields unpredictable results. If you're using a pure Id value (which is basically global class Id extends String), you'll automatically get to compare 15- and 18-character ID values, plus you'll get errors if someone tries to sneak in an invalid value (e.g. an ID with only 14 characters). In general, I find the Id class better to work with when I know that the result should be a valid Id, or at least looks like a valid Id. This can help eliminate common errors, such as stripping off too many characters, typos, and more. – sfdcfox Jul 8 '14 at 3:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.