function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
JeffreyStevensJeffreyStevens 

Sites page controller - anonymous write access

I have a site, with a page, and a custom controller.  The custom controller need to write a flat to a custom object.  This all needs to be done anonymous.  When I do the insert from the APEX controller - I get the Authorization Required message.  I want this to happen all anonymous.

Is that possible?
Best Answer chosen by JeffreyStevens
JeffStevensJeffStevens
Yep - that was it.  I've been in SF since 2009 - and how did I forget that you can't do DML in the constructor, or a method called from the constructor.  I put it in an page action method, and it worked just fine.

Thanks

All Answers

scottbcovertscottbcovert
Hi Jeffrey,

It is definitely possible to perform updates to custom object records from a Force.com site.

Beware of the authorization required message when hosting VFPages publicly on Force.com sites as it can be very misleading. Often times your true problem is some sort of a permission setting on either the Force.com site itself or the associated guest site user profile. The problem is the error thrown by Salesforce's server requires authorization to see and so the end user sees an Authorization Required message even when that isn't the true root of the issue.

I would take a look at your Force.com site and ensure access to the Apex controller and VFPage is enabled and also verify CRUD and FLS settings for the corresponding objects on the guest site user's profile.
JeffreyStevensJeffreyStevens
thanks - been checking all of the CRUD on the profile.  Page loads when I comment out the Insert ...., failes when it's in there.

Can I do the DML from the constructor of the controller?  Do it have to be in a helper class or anything like that?  Does it have to be global or just public?  How about with or without sharing?

thanks
scottbcovertscottbcovert
Hi Jeffrey,

I'd put your DML in its own separate method. The controller doesn't have to be global, but I would recommend using the with sharing annotation, especially if the class will be accessed from a Force.com site. While debugging it is probably a good idea to access the Visualforce page from within Salesforce (just by adding /apex/VFPage_Name after the salesforce.com domain) rather than through the Force.com site so you can better troubleshoot any bugs or issues. Good luck!
JeffStevensJeffStevens
Yep - that was it.  I've been in SF since 2009 - and how did I forget that you can't do DML in the constructor, or a method called from the constructor.  I put it in an page action method, and it worked just fine.

Thanks
This was selected as the best answer