I want to allow end-users (registered as users in Craft) to update only specific fields of an entry. I know that only those fields included in the form are being updated; but this isn't secure enough.
I'm looking for a way to manipulate the form POST request sent to the 'entries/save-entry' controller so that only specific fields will be updated. I know how to access the onBeforeSave event so that I can manipulate the entry object that will be saved to the database. I already use this to make sure that the user can only update one specific entry (because including the entryId in a hidden form field isn't secure enough).
However, I don't find a clever way to include only certain fields. The only way that comes into my mind is to overwrite all fields in the entry object that the user is not allowed to update with the current values from the database. This way is cumbersome because that entry type has so many fields.
Any idea how to filter the element so that I can supply an array with field names that will be included in the save process?
Best regards, Mischa