+ Start a Discussion
RstrunkRstrunk 

Apex and view/modify all

 

 

      So I used an APEX clas to allow a user to create a case on an account they do not have access to.  The Class is called from a VF page.  

 

The problem I am having is that once the case is created, the users profile somehow gains View All and Modify All for every object in the org.  This profile should not have view and modify all on ANY object in the org.  Is it because the class uses without sharing?  I'll post my code below.

 

//This Class is used to get the contact record of the current logged in user for use in a visualforce page.  


public without sharing class CC_getContact {
  public Contact theContact { get; set; } // You can use theContact on your page.

  public CC_getContact(ApexPages.StandardController controller) {
    Contact[] c = [SELECT Id FROM Contact WHERE FirstName = :UserInfo.getFirstName() AND LastName = :UserInfo.getLastName() and Email = :UserInfo.getUserEmail()];
    // Make sure you select all the fields you need.
    if(!c.isEmpty()) {
      theContact = c[0];
    }
  }
}

 

 

Any insight would be greatly appreciated.  

bob_buzzardbob_buzzard

Without sharing simply means that the sharing rules that would restrict a user's access to a record are ignored for methods in that class (and methods in other classes delegated to that don't explcitly have 'with sharing' keywords).

 

Apex code can't update the user's profile to grant View/Modify All Data permissions - that requires the metadata API.  Are you sure the profile you are testing with doesn't already have these permissions?

 

RstrunkRstrunk

 

    Yea, thats the strange part.  I check the profile first, there are no view/modify all boxes checked.  As soon as the user uses that apex class their profile gets updated for view/modify all on every object.  I am still new to SFDC so I may be missing something obvious.   

RstrunkRstrunk

 

    Oh, and on an unrelated thing, I ran accross your blog last week while researching something else.  Now here you are in the forums :-)  small world lol.