I have a plugin that will accept posted form data from a member group and then create or update a channel entry which that member group is not given permission to post or update in (via the control panel settings for member group permissions). The reason for the permissions restrictions is due to the way that the Channel Forms Module is implemented, and that allowing permissions gives users in that member group the ability to edit things they should not be allowed to unless the member group is restricted. It also seems best to follow the principle of least privilege in this case.

However, I do actually want the member group to be able to create an entry in the restricted channel when they initiate it by posting valid data through my plugin, but not be allowed to edit it after doing so. Thus, it becomes necessary to initiate a temporary session for a user from a member group with elevated posting/editing permissions to use the Channel Entries API save_entry function.

My question is whether this poses any security implications? If the session is set in the plugin and the php script somehow gets aborted before the session is closed, that gives the user elevated posting permissions and they will be logged-in as the elevated temporary session user. How can this be avoided? Is there a way to trigger EE to notice a new or edited entry by something like database query without initiating an elevated session?

  • Just so I understand the root issue: you need to allow members of a group to create entries in a certain channel, but never to edit (even their own), is that correct? May 22, 2014 at 16:50
  • Basically yes, that is what I am aiming for with this particular ecommerce implementation, although certain entries do require user-initiated edits at very specific points along the order process. As it stands, I've just decided to enable posting/editing permissions for the channels in question as I've explored the newer implementation of channel:forms and it seems more difficult to hack than previous iterations, although for ultimate peace-of-mind I'd still prefer to lock down those permissions within EE and control all edits with custom addons.
    – positlux
    May 23, 2014 at 0:41


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.