+ Start a Discussion
Anthony MealandAnthony Mealand 

Controller Extension to overwrite field level security

I have a button that calls a VisualForce page that I would like to overwrite the field level security i.e. fields that are read only will become editable in the VisualForce Page. I have created a the Class that acts without sharing and queries the relevant fields and returns them. The class and Visualforce page will both load, but the fields are still ready only. Any help would be appreciated!
public without sharing class MASIExtension {

        private final CustomObject__c INC;

    // The extension constructor initializes the private member
    // variable INC by using the getRecord method from the standard
    // controller.
    public MASIExtension(ApexPages.StandardController stdController) {
        this.INC = (CustomObject__c)stdController.getRecord();
    CustomObject__c I = [SELECT id, Name, customfield1__c, customfield2__c, 
                                            FROM CustomObject__c WHERE Id = :ApexPages.currentPage().getParameters().get('id')];

    public CustomObject__c getRecordName() {
        return I;

    public PageReference save(){
        update I;
        return null;

Visualforce page
<apex:page standardController="CustomObject__c" extensions="MASIExtension">
    <apex:form >
        <apex:pageBlock title="Enter MASI">
            <apex:pageBlockButtons location="bottom">
                <apex:commandButton value="Save" action="{!save}"/>
                <apex:commandButton value="Cancel" action="{!cancel}"/>                
            <apex:pageblockSection title="Legal Guardian" > 
                <apex:inputText value="{!CustomObject__c.customfield1__c}"/>            
                <apex:inputField value="{!CustomObject__c.customfield2__c}"/>
                <apex:inputField value="{!INC.Name_of_legal_guardian__c}"/>      

Piyush Sharma 6Piyush Sharma 6
Hi Anthony

I am not sure about this solution but you can check this if you havnt found anything yet.
Instead of using an extensions you can use a custom controller. FLS will not be enforced as the page sees the returned value as a string not an sObject.

You can refer this link for further info.