function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion

Protected Custom Settings exposed with global apex classes

I have a protected hierarchical custom setting that my app uses internally, and I'm interested in making it available via a global apex class to be edited outside our namespace, but with the apex class doing validation to ensure the provided values are "safe".


I've tried making a global apex class in the same namespace as the protected setting and I get a "permission denied" error when trying to call the class's save method to update the settings. Is there a way to do this?


It would make sense that my class in the same namespace as the setting could modify it even if it was initially called by a different namespace, correct?


Apex class in the publishing org (that contains the setting):


global with sharing class BaseSettings {
	private static BaseSettings instance = null;
	@deprecated global IncidentSettings__c incidentSettings {get; set;} 
	public static boolean isTest = false;
	//Load the default values for the sake of our testing.
	public static void isTest(boolean value){
		isTest = value;
	private BaseSettings(){
			incidentSettings = new IncidentSettings__c();
		} else {
	global static BaseSettings getInstance(){
		if(instance == null){
			instance = new BaseSettings();
		return instance;
	//Used by the constructor
	private void initIncidentSettings(){
		incidentSettings = IncidentSettings__c.getInstance();
		if(incidentSettings == null){
			incidentSettings = new IncidentSettings__c();

	global void save(){
		upsert incidentSettings;
	global boolean getIncidentBlockReopen(){
		return incidentSettings.blockReopen__c;
	global void setIncidentBlockReopen(boolean value){
		incidentSettings.blockReopen__c = value;
	global boolean getIncidentOwnerCloseOnly(){
		return incidentSettings.ownerCloseOnly__c;
	global void setIncidentOwnerCloseOnly(boolean value){
		incidentSettings.ownerCloseOnly__c = value;



Apex class in the customer org trying to use the settings class:


public with sharing class SettingsController {
        public itil_b.Settings baseSettings {get; set;}
        public SettingsController(){
                baseSettings = itil_b.Settings.getInstance(); 


And finally the vf page, which works until I hit save, at which point I get a generic "Insufficient Privileges" error.


<apex:page controller="SettingsController">
      <apex:outputLabel value="Incident Onwer Close Only" />
      <apex:inputCheckbox value="{!baseSettings.incidentOwnerCloseOnly}" />
      <apex:commandButton action="{!}" value="Save" />


Any Ideas? 




Make sure the user has access to the apex class on their user profile.  If that doesn't work, try removing the "with sharing" attribute on the class def.  Not sure if that will do the trick, but just an idea.  


No luck with the profile settings, I'm testing it with a system administrator profile. I'll test out removing with sharing and see if that works.