Yepp, this file, the save function should look like this
function save(){
$data = JRequest::get('post');
if(!class_exists('Permissions')) require(JPATH_VM_ADMINISTRATOR.DS.'helpers'.DS.'permissions.php');
if(Permissions::getInstance()->check('admin')){
$data['product_desc'] = JRequest::getVar('product_desc','','post','STRING',2);
$data['product_s_desc'] = JRequest::getVar('product_s_desc','','post','STRING',2);
}
parent::save($data);
}