I have 2 user groups K1 and NK1. NK1 are managers of K1.Custom object A_S has OWD private, with grant access. There is a sharing rule to give read-only access to K1 users of NK1 user's records. It works fine from workbench, while K1 tries to update NK1 record, it throws error: INSUFFICIENT_ACCESS_OR_READONLY. But from a visualforce page, that uses inline-editing K1 can edit NK1 records. How can I restrict such scenarios? inline-editing code part :

<apex:column > <apex:outputField value="{!k.Abv_Core_KAM_January__c}" id="January" > <apex:inlineEditSupport event="ondblClick" showOnEdit="saveButton,cancelButton" hideOnEdit="AddMoreButton"/> </apex:outputfield> </apex:column>

  • If you say NK1 are managers of K1 would you want to create a role hierarchy rather than a group which is basically a flat organisation type? – Mihai Neagoe Jan 27 '15 at 13:59
  • Hi @Mihai Neagoe there is a role-hierarchi in place along with group – user59759 Jan 27 '15 at 14:25

You need to enforce the sharing rules in the custom controller definition or in the standard controller extension:

Enforcing Sharing Rules in Controllers Like other Apex classes, custom controllers and controller extensions run in system mode. Typically, you want a controller or controller extension to respect a user’s organization-wide defaults, role hierarchy, and sharing rules. You can do that by using the with sharing keywords in the class definition. For information, see “Using the with sharing or without sharing Keywords” in the Force.com Apex Code Developer's Guide. http://www.salesforce.com/docs/developer/pages/Content/pages_compref_additional_controller.htm

| improve this answer | |

If I understand your problem, when you try and update the record of NK1 from a K1 user. The sharing rule you have only gives Read access, I suggest changing the sharing rule into a Read/Write permission.

Let me know if it helps.

| improve this answer | |
  • but i want to restrict editing, why should i give read/write in sharing rule? which works fine from workbench but with inline editing it is able to edit – user59759 Jan 27 '15 at 14:58
  • I see, have you looked at field level security for the K1 user? – Mihai Neagoe Jan 27 '15 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.