Grant and Audit the QCDR Manage PHP Tokens Permission

PHP Tokens execute administrator-authored server-side PHP, so QCDR protects their management with a dedicated Manage PHP Tokens Joomla action in addition to ordinary Token management. Max/All Access is also required for the PHP Token feature.

Grant this permission only to users who are already trusted to run arbitrary server-side code with the Joomla site's privileges.

Permissions Required to Author PHP Tokens

A normal delegated PHP Token administrator needs QCDR core.manage to enter the component, Manage Tokens for the Token workflow, and Manage PHP Tokens for PHP-backed Token actions. The current Effective tier must also allow Max.

QCDR's general permission helper treats core.admin as an override, so users with that authority should already be considered capable of PHP Token management.

The Dedicated Permission Is Enforced Server-Side

Manage PHP Tokens is not only a UI label. QCDR rechecks it when saving a PHP Token or an existing PHP-backed Token, changing PHP Token state (including bulk changes), deleting it, and duplicating it. Duplication also rechecks the Max feature gate.

A user who has Manage Tokens but not Manage PHP Tokens can continue managing ordinary non-PHP Tokens, but PHP-backed operations are rejected.

What the Permission Does Not Mean at Runtime

The ACL controls who can author and manage PHP Token code. Frontend visitors are not expected to hold that permission. Once an Enabled PHP Token has been saved by an authorized administrator, runtime execution is governed by QCDR's Max entitlement, Token targeting/state, live processing, and PHP safety/error handling—not by the visiting user's Manage PHP Tokens ACL.

Audit the Groups That Can Author Code

  1. Open Joomla's permissions editor for the QC Dynamic Replacer component.
  2. Identify every group with core.admin or explicit Manage PHP Tokens.
  3. Confirm those groups also have only the other QCDR/Joomla administration rights they genuinely need.
  4. Review group inheritance: a permission can arrive from a parent group, and core.admin acts as an override in QCDR's custom permission helper.
  5. Test a non-authorized Manage Tokens user and confirm PHP Token save/state/delete/duplicate actions are rejected.

Treat PHP Token Changes Like Code Deployment

PHP Tokens are not sandboxed. Review the code, prefer Once per page request and hidden frontend errors unless another behavior is specifically required, Preview on a controlled page when appropriate, and keep ordinary Rule/Token editors out of this permission unless they also have responsibility for server-side code.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.