Groundwire/EventbriteForSalesforce — Issue #41: User without sufficient permissions can create or update data
Author: groundwired
Created: 2012-02-14 17:18:25+00:00
State: open
Labels: Defect, Medium Priority

Apparently, Visualforce Javascript Remoting completely bypasses security, even when "with sharing" applies to the class. So our importAttendees function can create and update contacts, leads, and opps even if the person is not allowed to do so.

One solution is to provide properties for whether these objects are createable and updateable, and then disable options that they should not have. If they have no permission, the page should not allow even logging in. There may also be an apex solution that would cause the JS to get back errors - although it still would be better to alert folks before they try.

It is worth noting that Admins can disallow access to the page entirely for some or all profiles when installing - this would close the security hole. But they won't necessarily realize that.