Grant QCDR Preview and Discovery Permissions Safely

QCDR Preview and Discovery both use signed, short-lived frontend authorization, but their Joomla permission requirements are intentionally different in 1.1.05. Do not treat Test Rules and Run Discovery as interchangeable permissions.

Entitlement is also separate from ACL: Preview requires Pro or higher; Discovery requires Max/All Access, and the required Joomla permissions must still pass.

Private Rule Preview Requires core.admin and Test Rules

To issue or validate a private Preview authorization, the current code requires the user to have core.admin for QCDR and Test Rules. A non-Super-User/operator with Test Rules alone cannot launch a valid Preview session in 1.1.05.

The feature also requires Pro or higher. The signed token is bound to the user, the saved Rule ID, an expiry, and a nonce, and is valid for no more than 15 minutes.

Discovery Can Be Delegated More Narrowly

Discovery requires Max/All Access plus QCDR core.manage and Run Discovery. It does not require core.admin. That means a trusted non-Super-User Administrator can be allowed to launch Discovery without receiving the broader Super User authority required by Preview.

If that user should turn a Discovery selection into a Draft Rule, also grant Manage Rules; the handoff to the Rule editor is permission-checked separately.

Both Frontend Sessions Recheck the Current User

The signed authorization is not a permanent bearer permission. QCDR reloads the signed user and rechecks that the account is valid/not blocked and still has the required ACL before accepting the private request. Expired, tampered, or no-longer-authorized sessions fail closed.

Private Does Not Mean Sandboxed

Preview/Discovery responses receive private/no-store/noindex protections, and Discovery also applies a no-referrer boundary. Those controls protect the diagnostic session from normal caching/indexing; they do not sandbox PHP Tokens or eliminate side effects from custom code that a Preview actually executes.

Grant the Smallest Appropriate Role

  • Grant Run Discovery only to trusted QCDR managers who need frontend analysis.
  • Do not grant core.admin merely as a convenience to make Preview work; in current 1.1.05 Preview is effectively reserved for users who already warrant that authority.
  • Keep Manage Rules separate if Discovery users should analyze output but not save/edit Rules.
  • Re-test after ACL changes; old private URLs expire quickly and may need to be relaunched.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.