Why an Unlicensed User able to fetch data from a Managed Packaged Custom Object?

Question

Assuming I've 2 users in my org: [User A] & [User B]

Assuming I've a Managed Package CustomObject: [abc__XYZ__c]

IMPORTANT:

• [User A] - has been assigned a License of this Managed Package.
• [User B] - DO NOT have a User License to this Managed Package.

Consider these 3 Visualforce Pages & respective Apex Classes:

1. Test1
2. Test2 / Test2Controller
3. Test3 / Test3Controller

Code for the Pages/Classes is as follows:

Test1 VF Page:

<apex:page standardController="abc__XYZ__c">
    <apex:pageBlock>
        <apex:pageBlockSection columns="1">
            <apex:outputField value="{!abc__XYZ__c.Name}" />
            <apex:outputField value="{!abc__XYZ__c.abc__TotalAmount__c}" />
        </apex:pageBlockSection>
    </apex:pageBlock>
</apex:page>

---

Test2 VF Page:

<apex:page controller="Test2Controller">
    <apex:pageBlock>
        <apex:pageBlockSection columns="1">
            <apex:outputText value="{!mysObjVar['Name']}" />
        <apex:outputText value="{!mysObjVar['abc__TotalAmount__c']}" />
        </apex:pageBlockSection>
    </apex:pageBlock>
</apex:page>

Test2Controller APEX Class:

public with sharing class Test2Controller {
    public abc__XYZ__c mysObjVar { get;set; }
    
    public Test2Controller() {
        mysObjVar = new abc__XYZ__c();
        abc__XYZ__c[] b = [select Id, name, abc__totalamount__c from abc__XYZ__c where id =: ApexPages.currentPage().getParameters().get('id')];
        if (b.size() > 0)
            mysObjVar = b[0];
    }
}

---

Test3 VF Page:

<apex:page controller="Test3Controller">
    <apex:pageBlock>
        <apex:pageBlockSection columns="1" title="via sObject">
            <apex:outputText value="{!mysObjVar['Name']}" />
            <apex:outputText value="{!mysObjVar['abc__TotalAmount__c']}" />
        </apex:pageBlockSection>
        <apex:pageBlockSection columns="1" title="via Custom">
            Name: <apex:outputText value="{!sName}" />
            Total: <apex:outputText value="{!sTotal}" />
        </apex:pageBlockSection>
    </apex:pageBlock>
</apex:page>

Test3Controller APEX Class:

public with sharing class Test3Controller {
    public sObject mysObjVar { get;set; } 
    public string sName { get;set; }
    public decimal sTotal { get;set; }
            
    public Test3Controller() {
        Schema.DescribeSObjectResult dr = Schema.getGlobalDescribe().get('abc__XYZ__c').getDescribe();
        if( dr.isAccessible() && !dr.isDeprecatedAndHidden() && dr.isQueryable() )
        {
            mysObjVar = Schema.getGlobalDescribe().get('abc__XYZ__c').newSObject();
            string recordid = ApexPages.currentPage().getParameters().get('id');
            sObject[] b = database.query('select Id, name, abc__TotalAmount__c from abc__XYZ__c where id =: recordid');
            if (b.size() > 0) {
                mysObjVar = b[0];
                sName = (string) b[0].get('Name');
                sTotal = (decimal) b[0].get('abc__TotalAmount__c');
            }
        }
    }
}

---

Now:

• If I access, via [User A]: Test1, Test2, and Test3 VF pages in browser with a valid Record Id, I get ALL these 3 VF pages show me Values for the fields I have shown.

• If I access, via [User B]:

  • Test1 VF page show "Insufficient Privileges" error.
  • Test2 VF page show me Empty Page.
  • Test3 VF Page show me Empty Section when access via sObject[fieldName] BUT show me Actual Values in field in a section when I use String Property to fetch the field values (image attached)

And so my question, how can a User who does not have a License to the Package be able to Fetch Data, and be able to display it to user via a Custom Property, but not via an sObject instance variable or direct object instance variable?

To me it seems like a big Bug in platform! Ideally I don't think it should every allow reading of Data to any User who does not have access to the Managed Package via Licenses and Describe() Calls should respect that, shouldn't they?

Answer 1

To test whether a user has access to a managed package, there is a method

UserInfo.isCurrentUserLicensed( String namespace )

All of your examples above are consistent with the lack of enforcement of pretty much any permissions on CRUD/FLS at the Apex/SOQL level. This is an ongoing thorny topic that's been covered unhappily in many threads on the Dev Forums, the Partner Community, etc. Take a read if you have time:

https://developer.salesforce.com/forums/ForumsMain?id=906F00000009JFXIA2

Your Test1 page uses a standard controller so it enforces CRUD/FLS .. but the other two Apex controllers (Test2Controller and Test3Controller) are running in system context and bypass CRUD/FLS.

Your example in Test3 page shows the hacky behavior of using a field reference to an SObject versus a String that was assigned in Apex.

This doc pretty much covers it:

https://developer.salesforce.com/page/Testing_CRUD_and_FLS_Enforcement

Answer 2

UPDATE: This answer is incorrect, as both users have CRUD permissions at the profile level to the object.

It gets a bit confusing because the platform tries to do CRUD/FLS checks for you (whenever it can). It can do these checks at the apex level (when you use a standard controller) or at the visual force layer (when its clear which field is being referenced).