1

I have created a custom controller that extends a standard controller. My custom extension is defined 'without sharing'. Nevertheless, it seems to execute 'with sharing'.

I get the feeling that an extension of a standard controller always runs in user mode. Is that correct?

Here is my code:

public without sharing class SickLeaveExt {
    private SickLeave__c sickLeave;
    public SickLeaveExt(ApexPages.StandardController SickLeaveController) {
        this.sickLeave= (SickLeave__c)SickLeaveController.getRecord();
    }
}

And the VF page is this: showheader="true" sidebar="true" tabstyle="SickLeave__tab"> ...

Any suggestions?

Best regards, Marco

1

VisualForce will enforce Sharing and Field Level Security, even though the APEX controller might not be enforcing sharing.

  • alsjeblieft Harm je eerste puntjes :-) – Guy Clairbois Sep 18 '14 at 14:27
0

thanks Harm, that was what i was looking for. .

I have made a workaround, here it is:

public with sharing class SickLeaveExt {

public SickLeave__c sl {get;set;} private NonSharingData globalData = new NonSharingData();

public SickLeaveExt(ApexPages.StandardController SickLeaveController) { this.sl = globalData.getSickLeave(sickleavecontroller); }

without sharing class NonSharingData {
SickLeave__c getSickleave(ApexPages.StandardController s) { SickLeave__c sl = [ SELECT Id,Name FROM SickLeave__c WHERE Id = :s.getId() ]; return sl; //by the way, return (SickLeave__c)s.getRecord(); does not work } } }

In my VF page i use sickleave instead of SickLeave__c.

I know that this is not the final solution, for anyone can manipulate the url and gets access to the record. But it gives me a way out. What i will do is add a check on who's trying to access the record. In my case, only the user that owns one of the tasks related to the record will be granted access.

Again, thanks!

Marco

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.