QC Dynamic Replacer Joomla ACL Permissions Explained

QCDR separates Administrator access from specific management actions. Joomla core.manage controls entry to the QCDR Administrator component, while QCDR actions control settings, entitlement, Rules, Tokens, PHP Token authoring, testing, Discovery, and the frontend Workspace.

Plan entitlement and ACL are separate gates: granting a Joomla permission does not unlock a Pro/Max feature that the current Effective tier does not include.

Administrator Access and Super User Override

  • core.manage: required to open the QC Dynamic Replacer Administrator component.
  • core.admin: acts as an override for QCDR's normal custom-action helper and is also required by the private Rule Preview authorization path. The Entitlement Revalidation repair action is Super User/core.admin-only.

QCDR Management Actions

  • Manage Settings: change Runtime Safety settings and Rule/Token Live Processing.
  • Manage License: refresh entitlement, start an eligible one-time Max Preview, and clear legacy saved-key state.
  • Manage Rules: create, edit, organize, change state, duplicate, and delete Rules.
  • Manage Tokens: create, edit, organize, change state, duplicate, and delete non-PHP Tokens, subject to additional PHP restrictions.
  • Manage PHP Tokens: additional high-risk permission required to author or manage PHP-backed Tokens.
  • Test Rules: required for private Preview/Rule Health, but current Preview also requires core.admin.
  • Run Discovery: required for private Discovery; current Discovery also requires QCDR core.manage.
  • Use Workspace: defined for the frontend Workspace, but 1.1.05 also admits any authenticated user through a registered-user fallback.

Feature Tier Still Applies

ACL does not override Basic/Pro/Max gates. For example, Preview requires Pro or higher; Discovery and PHP Tokens require Max/All Access. A user can hold the Joomla permission yet still see the feature unavailable because the Effective tier is lower.

Server-Side Checks Matter

QCDR does not rely only on hidden buttons. State-changing Administrator POST actions recheck the relevant permission and Joomla CSRF token on the server. PHP Token actions add their dedicated permission checks. This is why changing a form request or URL does not legitimately bypass a missing permission.

Design Roles Around Jobs, Not Tabs

Give each Joomla group only the actions it needs. A content/runtime operator might receive core.manage plus Manage Rules and Manage Tokens, while entitlement, settings, PHP code, and Discovery remain with smaller trusted groups. Test the resulting role with a non-Super-User account before relying on it.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.