function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
JR NonprofitJR Nonprofit 

Visual Force Object Security

I'm getting some strange behavior on a visual force page that I can't explain.
 
I have created a custom object. I have the profile of the user set to disallow editing for that object.  When I look at my object using the standard page layout, I can't edit anything, which is the behavior I would expect.  But when I create a visual force page with a custom controller, I can't edit anything there either.  The page appears, but none of the fields are editable (using inputField).  I thought that custom controllers ignored profile based security unless certain explicit measures were taken.  I am using the visual force page because I want to control security on this object in a customized manner.  Any suggestions on what I might be doing wrong?
 
If I change the profile security to allow editing and turn on in line editing in the user interface, the in line editing does not work on a visual force page (using InputField).  Any ideas on what might be going on here?
 
Thanks in advance for your help,
Jeff
 
jwetzlerjwetzler
Custom controllers run in system mode, so you can actually get and set data even if you don't have the correct perms.  Visualforce pages however run as the user who is viewing them, and therefore respect CRUD, FLS, etc.  You could probably get around this using inputText components and then wiring up all of the fields in your controller... why are you looking to allow users to edit something they can't normally edit?
JR NonprofitJR Nonprofit

Jill,

Thanks for your quick response.

I guess I assumed that if I retrieved the data through the custom controller that it would be made available to the page and that the page respected the data as presented by the controller.  Essentially that would allow me to override profile security in very special circumstances.  Your explanation clears up for me how it is actually working.

In general, I did not want the user to edit the data except under very controlled circumstances which I thought I could better handle in a Visual Force page.  Hence, I thought that I could control things better by not allowing editing unless the user was on my page.

Do you know the answer to my inline editing question?  Do inputfields on a visual force page allow inline editing?

Again, thanks for your quick response.

Jeff
David VPDavid VP


I've seen the exact same behavior : no inline editing in VF pages (I guess the components are good but not *that* good yet).


David