#SecureCommunities  #Securesites #SecureMyGuestUser 

We are preparing our products suite for Winter20 security changes and facing issues with Site inserting and retrieving record in same context/transaction.

@George Abboud - Based on your recommendation, Read access will need to be granted via Guest Sharing Rules, and Edits will need to be done via Apex methods running in without sharing mode. But this does not work when Site inserts a record and retrieve that record in same context. Please check below implementation for creating and updating Contact from site -

1. Guest sharing rule on contact with criteria created by user not equal to null. Technically, Site guest user should be able to read all contacts.
2. Site guest user insert contact and retrieve contact in with sharing class. Technically, this should work because site user has create contact permission on profile and sharing guest rule to read created contact. But no contact is retrieved, please check below snippet code:

//Step 1- insert from site

contact c = new Contact();

c.lastname = 'Test';

insert c;

//Step 2 - retrieve from site

c = [Select Id,LastName from Contact Where Id = :c.id];

We are not able to retrieve inserted contact and due to this we need to move our read logic into without sharing apex class for sites. We want to highlight this because Appexchange Security review team does not allow without sharing apex and takes months to approve.

Please share your thoughts.

Thanks

Manish