0

I have a trigger which runs with sharing. All I am doing in this class is updating or inserting another sObject on afterInsert or afterUpdate.

Trigger is running in system context Profile/user used to update/insert sObject has read only permission.

I am wondering how it is allowing the user to perform update/insert DML operation where he has Read Only access.

I don't have any execute anonymous or system runs or any inner class. Its one method in trigger.

Unable to figure out what I am missing here as it should not allow any DML operations on Read only object.

TriggerInterface_ims{ 

public void afterInsert(Map<Id, Sobject> mapNew){ 
  //Convert Map To List 
  List<sObject> listsObject = new List<sObject>(); 
  listsObject = convertMapToList(mapNew,listsObject); 
  //Upsert to the another
   sObject upsertanotherCustomsObject(listsObject); 
} 

private static void upsertanothersObject(List<sObject> listsObject){ 
  // some business logic 
  upsert listanotherCustomsObject; 
}
  • Did you mean to say that the code is running "without sharing"? Can you post the code? – PepeFloyd Oct 19 '14 at 20:15
  • Code is running with sharing. public with sharing class sObjectTrigger implements TriggerInterface_ims{ public void afterInsert(Map<Id, Sobject> mapNew){ //Convert Map To List List<sObject> listsObject = new List<sObject>(); listsObject = convertMapToList(mapNew,listsObject); //Upsert to the another sObject upsertanotherCustomsObject(listsObject); } private static void upsertanothersObject(List<sObject> listsObject){ // some business logic upsert listanotherCustomsObject; } – user360 Oct 21 '14 at 1:57
0

You are right salesforce allows user to perform DML although user doesn't have permission for that particular DML operation.

In salesforce security review they also enforce us to check CRUD and FLS issue. It means we need to write the code which will check for the particular permission of the object and its fields.

The security check are divided into 2 parts :

  1. CRUD

    Suppose User is trying to insert Account from custom code and he is not having permission then before performing DML (insert) we suppose to check whether user is having create (insert) permission for Account object. If user is not having permission then do allow him to insert the data.

  2. FLS

    Suppose User is trying to update the Account record and User is having Update permission for Account object. But user do not having update permission for Account field lets say website. So while performing this DML operation code should check for the update permission of all the fields which user is updating in code.

For more detail you can check this URL : Enforcing CRUD and FLS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.