I have a plugin that will accept posted form data from a member group and then create or update a channel entry which that member group is not given permission to post or update in (via the control panel settings for member group permissions). The reason for the permissions restrictions is due to the way that the Channel Forms Module is implemented, and that allowing permissions gives users in that member group the ability to edit things they should not be allowed to unless the member group is restricted. It also seems best to follow the principle of least privilege in this case.
However, I do actually want the member group to be able to create an entry in the restricted channel when they initiate it by posting valid data through my plugin, but not be allowed to edit it after doing so. Thus, it becomes necessary to initiate a temporary session for a user from a member group with elevated posting/editing permissions to use the Channel Entries API save_entry function.
My question is whether this poses any security implications? If the session is set in the plugin and the php script somehow gets aborted before the session is closed, that gives the user elevated posting permissions and they will be logged-in as the elevated temporary session user. How can this be avoided? Is there a way to trigger EE to notice a new or edited entry by something like database query without initiating an elevated session?