Allow registered end-user to update entry, but limited only to specific fields (Craft 3)

Question

I want to allow end-users (registered as users in Craft) to update only specific fields of an entry. I know that only those fields included in the form are being updated; but this isn't secure enough.

I'm looking for a way to manipulate the form POST request sent to the 'entries/save-entry' controller so that only specific fields will be updated. I know how to access the onBeforeSave event so that I can manipulate the entry object that will be saved to the database. I already use this to make sure that the user can only update one specific entry (because including the entryId in a hidden form field isn't secure enough).

However, I don't find a clever way to include only certain fields. The only way that comes into my mind is to overwrite all fields in the entry object that the user is not allowed to update with the current values from the database. This way is cumbersome because that entry type has so many fields.

Any idea how to filter the element so that I can supply an array with field names that will be included in the save process?

Best regards, Mischa

Answer 1

You can include a custom Behavior like the ContentBehavior/ FieldLayoutBehavior in Craft 3 and handle those by yourself. This way you'll be able to handle permissions by yourself. There are certain Control Panel Hooks to include custom HTML.

1. Create a custom Behavior that's kind of a wrapper for the usual ContentBehavior
2. Store "special/extra" fields for those Elements in a custom table
3. Render those extra fields in a custom panel/tab
4. store those new values in your custom Table in beforeSave and afterSave funktions

But in general creating a custom Element Type would be easier to achieve, since you'll have more possibilities and more freedom to do what you want