I'm trying to clarify VF controller context versus Sites Guest User permissions on Contact record.
From everything I've read, a VF controller using "without sharing" operates in the system context. Does this mean a VF page on a Force.com Site essentially has full CRUD permissions on the Contact object, for example?
If so, why does the Guest User profile allow only Read/Create permissions (through Public Access Settings) on the Contact record? It seems like the only reason I need to set Read permissions for Guest User is if I am referencing an object's fields on the page using inputField. Otherwise, selects and DML in the controller are in system context and thus ignore the profile's object permissions. Is that correct?