I created a profile with no special privilege like author apex(which is a combination of modify all data and view and setup configuration)given to it. The visualforce page is made accessible to the user of this profile using profile setting,controller is a with sharing class and it is made inaccessible to this user using apex class security.
Now this class has getGo() which returns string "inside go.." Call to this method is made using {!go} inside vf page.
Now when I login with the username of the stated profile and view this vf page I am able to see the output "inside go...." which according to me should not be the case as the class does not allow this user to access it.

Also referring to this link When to add apex class permissions to a profile it is stated here by user sfdcfox that - "The controller is also invoked through a Visualforce context, so long as the page has permission, any of that classes functions which are accessed by actionFunction calls, actionPoller calls, or even @RemoteAction annotations, are also granted access"
So does this statement mean that - if a user has access to the visualforce page then user can call any method of the controller class for which the user does not have access to! I think I am missing some major concept here.
Thanks in advance !


"With Sharing" only controls whether sharing rules are fired, not other security settings.

And if a user has "Author Apex" permission, they can access all Apex classes in the organization.

Make sure you thoroughly read and understand the various security documents like the couple I've linked to, as many of these platform features don't necessarily behave in the manner you may assume at first glance.

| improve this answer | |
  • Thanks jkraybill for your quick response. I have couple of doubts. Please clarify ! Referring to this shared link "With Sharing only controls whether sharing rules are fired", can you please elaborate this. Is it is like that "with sharing" ensures object and field level security of the current user not apex class security of the current user . – Monalisa Das Apr 28 '15 at 6:55
  • No... you'll honestly need to thoroughly read the security docs to understand the various aspects of platform security. "With Sharing" only affects row-level sharing rules (record visibility), not CRUD/FLS. This thread may also assist your understanding: salesforce.stackexchange.com/questions/16176/… – jkraybill Apr 28 '15 at 7:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.