Configure Joomla Groups Frontend Managers May Assign or Remove

When Max/All Access group editing is enabled, Groups frontend managers may assign/remove defines the direct Joomla memberships a delegated manager may change. This target-group list is separate from the source groups that control visibility and the editable groups that control which users may be changed.

QCFUM preserves unrelated direct memberships outside the allowed target set instead of replacing the user’s entire Joomla group list.

Enable Group Editing Deliberately

  1. Open Components > QC Frontend User Manager > Settings.
  2. Find Frontend User Manager Settings.
  3. Under Groups frontend managers may assign/remove, select only safe destination groups.
  4. Enable the separate Change Joomla groups User Manager action only when the delegated role genuinely needs it.
  5. Save and test with a non-Super-User manager and an ordinary target account.

Only Allowed Target Groups Are Offered

The management form displays the administrator-approved target groups. On submit, QCFUM intersects the requested IDs with the allowed set and removes protected groups from the allowed set before applying anything. If the request contains a group outside the approved set, the change is refused rather than silently widening access.

Group Changes Operate on Direct Membership

The source/editable/protected eligibility checks understand Joomla’s ancestor hierarchy, but the write itself changes the user’s direct group memberships. QCFUM does not materialize inherited parent groups as new direct assignments.

Unrelated Existing Groups Are Preserved

When saving a group change, QCFUM reads the target’s existing direct memberships. It preserves memberships that are outside the allowed-target set, then replaces only the manageable portion with the selected allowed groups. This prevents a delegated edit from stripping unrelated memberships that the frontend manager was never authorized to control.

Protected Groups Cannot Become Targets

QCFUM removes its protected-group set from the allowed target list. Administrative/backend-capability groups therefore cannot be made assignable merely by selecting them in an overly broad configuration.

Current Save Requirement

In 2.0.4, the group-change validator requires at least one allowed target group to remain selected when the group form is saved. If the operational design needs a user to have no delegated-manageable group at all, handle that account through an administrator-controlled workflow rather than trying to submit an empty allowed selection.

Verify Safely

  • Add one allowed ordinary group and confirm it becomes a direct membership.
  • Remove one allowed group while leaving another selected and confirm only the manageable membership changes.
  • Confirm an unrelated existing group remains attached.
  • Confirm a protected or non-allowed group cannot be submitted successfully.

Community Discussion

Want to compare Joomla user-management safeguards, share practical QCFUM configuration ideas, or discuss how other administrators delegate frontend workflows? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.