I have a picklist field "Status" on a custom object. I've set the field level security to read-only for all profiles except for the system administrator profile. So, from the UI, no user can edit this field. However, I have created a custom button that uses a web service method to update this field from one status value to another status value. I only want the users to update this field from the custom button and not manually thru the page layout (UI). I get insufficient privileges. Is there a way to allow the user to bypass the field level security using apex. I tried setting the class to "without sharing", but that didn't work?

Here is my apex code:

global without sharing class RevisionRequestCloseSendApproval {

WebService static String closeRequestSendOrderApproval(String requestId)
    try {
        Revision_Request__c request = [select Status__c, Order__c from Revision_Request__c where Id =: requestId];
        request.Status__c = 'Closed';
        update request;

        SalesOrder__c so = [Select Status__c from SalesOrder__c where Id =: request.Order__c];
        so.Status__c = 'Awaiting Customer Approval';
        update so;

        return 'OK';
    catch(Exception e) {
        return e.getMessage();

2 Answers 2


Suggestion: have you added the RevisionRequestCloseSendApproval class to the permitted users profile(s) in the 'Enabled Apex Class Access' section ? If rather than setting access at a profile level you'd prefer to assign on a per-user basis, also consider use of a 'permission set' as an alternative - then you achieve very granular access to the functionality you've created. Hope this helps.

  1. One other way is to Open up field level security access to all Profiles in Salesforce.
  2. Then check"Read Only" Option from Page Layout for "Status".
  3. Enable the above page-layout for all profiles, except System Admin.
  4. Now, you won't be having any permission issues in Apex Code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .