Pages

Thursday 2 February 2012

system.security.NoAccessException : Update access denied on Pricebookentry

In my current assignment, I got a very strange issue which made me frustrated .

My task was to customize the "Add Product" functionality on Opportunity. Every thing was working fine until it was tested with the profile wherein no CREATE or EDIT permission was granted for PRICEBOOK sObject.
My own code rewarded me the exception

system.security.NoAccessException : Update access denied on Pricebookentry

at the final stage of adding products (on hitting the SAVE button).

I was puzzled because I used only one DML statement in my controller extension that was insert statement against OpportunityLineItem. I commented the insert statement and was still getting the same exception. If I provide CREATE or EDIT permission for PRICEBOOK then I was not getting the exception.

Bad luck, that I could not grant permision to some profiles as security was also a concern. I needed to play with my code and finally I resolved it after a hard work.

I used a Relationship query to get data from product2,pricebookentry,Pricebook2 objects. This gives me a list of pricebookentry.I used this  list of PriceBookEntry and bind it to PageBlockTable on my visualforce page. But when I hit save, I suspect the getter method of that list was generating the exception.

I never thought that Wrapper class  can save me in this situation.

Now I think I should share the resolution. Instead of binding the PageBlockTable with the list of pricebookentry, I created a wrapper class in following format :


 public class WrapPirceBook
    {
       Public Product2 prod {get;set;}
       public Decimal UnitPrice {get;set;}
       public ID Product2Id;
       public ID Pricebook2Id {get;set;}   
       public ID mainID {get;set;}   
        
       public WrapPirceBook(Product2 pro,Decimal u,ID p,ID c,ID ids) 
       {
            prod=pro;
            UnitPrice=u;
            Product2Id=p;
            Pricebook2Id=c;
            mainID =ids;
        }
    }
Now I am not using pricebookentry directly, instead I am doing all the stuff but without direct access of pricebookentry. After this implementation, when I hit save, I was on Cloud9. I was very happy to see that when I click on save, it saved all the selected products with the Opportunity.

I used wrapper class to resolve the issue but still I was using pricebookentry instead of Product2. I wanna say special thanks to my MANAGER who directed me to use Product2 instead of pricebookentry in the wrapper class.

Hope this helps if someone gets the same or similar problem. However, I am open if any body wants my help to get more knowledge about this functionality.

9 comments:

  1. The problem is with an inputHidden or inputField directly bound to an sobject field that the user doesn't have access to. Wrapping it will fix it, but it's the Rube Goldberg of solutions. This is a developer-created problem, not an SFDC bug. If the page works fine with a wrapper, you obviously didn't need that as a real input in the first place. Look for your sobject bindings and minimize them.

    ReplyDelete
  2. Hi I am having a similar issue. When I am trying to update contact from site pages. Site user does not have access to edit contact. please help me its really urgent.
    thanks in advance

    palak agarwal
    prismatic.palak@gmail.com

    ReplyDelete
    Replies
    1. PLEASE PING SAHRE THE SAME INFO TO VCR.VENU@GMAIL.COM AS I'M FACING SAME KIND OF ISSUE. THANK YOU.

      Delete
  3. Hi Niket can you please tell me for what profile you were getting this error

    ReplyDelete
    Replies
    1. I was getting this error for community user

      Delete
  4. Thank you for sharing this! I was on the trail of some strange permission-like issues with PBE and lo and behold your article confirmed it. Updating my wrapper class also solved the issue for me. Error I was getting btw was:


    EXCEPTION_THROWN|[EXTERNAL]|System.VisualforceException:
    Update access denied for PricebookEntry, controller action methods may not execute.

    ReplyDelete