Control Who Can Access the QCDR Frontend Workspace

QCDR defines a Joomla ACL action named Use Workspace, but current 1.1.05 frontend code also contains a registered-user fallback: any authenticated non-guest user who reaches the Workspace is accepted by the component helper.

That means the current QCDR ACL action should not be treated as a reliable deny control for registered users. Use the Workspace as a low-sensitivity readiness view and understand the routing/menu limitation before promising a narrower security boundary.

Guest Behavior

If a guest reaches the QCDR Workspace component, the current view returns a Sign in required message and explains that the Workspace is for registered Joomla users. Your Joomla menu Access level can require authentication before the component view is reached.

The Current Registered-User Fallback

The QCDR permission helper grants an action when the user has core.admin, has the requested QCDR action, or—for qc_dynamic_replacer.use_workspace specifically—is simply not a guest. As a result, a normal authenticated user passes the Workspace check even when the custom Use Workspace action itself is not allowed.

An explicit Joomla ACL deny on Use Workspace therefore is not sufficient by itself to block a registered user in 1.1.05.

What the Joomla Menu Access Level Controls

The menu item's Access level controls whether Joomla displays/allows that menu item for a View Access Level. Use it to keep the navigation link limited to the intended group. However, because the component itself accepts authenticated users, do not describe the menu Access level as a complete defense against direct component routing.

Keep Sensitive Administration in Administrator

The current Workspace exposes a version/readiness summary and stored/enabled Rule/Token counts; it does not expose Rule bodies, Token values, PHP code, entitlement controls, or editing actions. Keep sensitive QCDR administration in Joomla Administrator behind core.manage and the specific management permissions.

If You Need a Stricter Workspace Boundary

Do not rely on the QCDR Use Workspace ACL alone in 1.1.05. If your security requirement is that only a subset of registered users can ever open the component route, treat that as a current product limitation and use an external Joomla/site access control or contact QuantaCade support for a supported restriction strategy.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.