Answers.Body: <p>You can include a custom <a href="https://www.yiiframework.com/doc/guide/2.0/en/concept-behaviors" rel="nofollow noreferrer">Behavior</a> like the <code>ContentBehavior</code>/ <code>FieldLayoutBehavior</code> in Craft 3 and handle those by yourself. This way you'll be able to handle permissions by yourself. There are certain <a href="https://docs.craftcms.com/v3/extend/updating-plugins.html#control-panel-template-hooks" rel="nofollow noreferrer">Control Panel Hooks</a> to include custom HTML.</p>
  
  <ol>
  <li>Create a custom Behavior that's kind of a wrapper for the usual <code>ContentBehavior</code></li>
  <li>Store "special/extra" fields for those Elements in a custom table</li>
  <li>Render those extra fields in a custom panel/tab</li>
  <li>store those new values in your custom Table in beforeSave and afterSave funktions</li>
  </ol>
  
  <p>But in general creating a custom Element Type would be easier to achieve, since you'll have more possibilities and more freedom to do what you want</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-08T15:03:32.433Z
Answers.Text: Thanks for your inputs. I will try this out in the next days and will let you which solution worked better for me!
Answers.UserDisplayName: Mischa Sz.
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-06T14:06:35.410Z
Answers.LastActivityDate: 2018-08-06T14:06:35.410Z
Answers.UserDisplayName: Robin Schambach
Body: <p>I want to allow end-users (registered as users in Craft) to update only specific fields of an entry. I know that only those fields included in the form are being updated; but this isn't secure enough.</p>
  
  <p>I'm looking for a way to manipulate the form POST request sent to the 'entries/save-entry' controller so that only specific fields will be updated. I know how to access the onBeforeSave event so that I can manipulate the entry object that will be saved to the database. I already use this to make sure that the user can only update one specific entry (because including the entryId in a hidden form field isn't secure enough).</p>
  
  <p>However, I don't find a clever way to include only certain fields. The only way that comes into my mind is to overwrite all fields in the entry object that the user is not allowed to update with the current values from the database. This way is cumbersome because that entry type has so many fields.</p>
  
  <p>Any idea how to filter the element so that I can supply an array with field names that will be included in the save process?</p>
  
  <p>Best regards,
  Mischa</p>
  
Tags: <saveentry><onsaveentry>
Title: Allow registered end-user to update entry, but limited only to specific fields (Craft 3)
ThreadText: # Allow registered end-user to update entry, but limited only to specific fields (Craft 3)
  
  (Asked by: username_0 on 2018-08-06)
  
  I want to allow end-users (registered as users in Craft) to update only specific fields of an entry. I know that only those fields included in the form are being updated; but this isn't secure enough.
  
  I'm looking for a way to manipulate the form POST request sent to the 'entries/save-entry' controller so that only specific fields will be updated. I know how to access the onBeforeSave event so that I can manipulate the entry object that will be saved to the database. I already use this to make sure that the user can only update one specific entry (because including the entryId in a hidden form field isn't secure enough).
  
  However, I don't find a clever way to include only certain fields. The only way that comes into my mind is to overwrite all fields in the entry object that the user is not allowed to update with the current values from the database. This way is cumbersome because that entry type has so many fields.
  
  Any idea how to filter the element so that I can supply an array with field names that will be included in the save process?
  
  Best regards,
  username_0
  
  **Tags:** saveentry, onsaveentry
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-08-06. Score: 1
  
  You can include a custom [Behavior](https://www.yiiframework.com/doc/guide/2.0/en/concept-behaviors) like the `ContentBehavior`/ `FieldLayoutBehavior` in Craft 3 and handle those by yourself. This way you'll be able to handle permissions by yourself. There are certain [Control Panel Hooks](https://docs.craftcms.com/v3/extend/updating-plugins.html#control-panel-template-hooks) to include custom HTML.
  
  1. Create a custom Behavior that's kind of a wrapper for the usual `ContentBehavior`
  2. Store "special/extra" fields for those Elements in a custom table
  3. Render those extra fields in a custom panel/tab
  4. store those new values in your custom Table in beforeSave and afterSave funktions
  
  But in general creating a custom Element Type would be easier to achieve, since you'll have more possibilities and more freedom to do what you want
  
  > **Comments:**
  > **username_0**: Thanks for your inputs. I will try this out in the next days and will let you which solution worked better for me!  
  
  ---
  
  