Configure QCFUM Frontend Permissions
QCFUM’s frontend ACL separates onboarding and existing-user-management duties so a staff account can receive only the workflows it actually needs. Configure the permissions for the Joomla group used by those staff members, then test with a real non-Super-User account.
Plan entitlement is still required in addition to ACL. Granting a QCFUM action does not unlock Pro- or Max-only features on a lower Effective tier.
The Five Current Frontend Actions
| Permission | Typical dashboard effect |
|---|---|
| Create Users from the Frontend | Create User; also the create authorization used by eligible Join Code paths. |
| Send Invite Links from the Frontend | Invitations / creation of Invite Links. |
| Import Users by CSV from the Frontend | Import tab when CSV is also available to the Effective tier. |
| Manage Own Invite Links | Recent Users / Tracker and resend/cancel tracking actions available to the user. |
| Use the Frontend User Manager | Users tab and enabled existing-user actions when Max/All Access and User Manager safeguards also allow them. |
Configure the Real Staff Group
Set these actions on the Joomla group that staff actually use. Avoid testing only through a Super User account, because Super Users automatically pass the QCFUM action checks and can hide mistakes in delegated ACL configuration.
Explicitly Configure New Actions on Upgraded Sites
QCFUM 2.0.4 keeps a compatibility fallback for sites that have not yet configured the newer frontend actions: an authenticated user can continue through the older menu/access-level model. Once an action has explicit Joomla ACL rules, QCFUM uses those rules. For production delegation, configure the actions deliberately so the menu level is not carrying the whole security burden.
Match Permission to Tier
- Create, Invite, and tracking workflows can be available from Basic upward when configuration allows them.
- CSV requires Pro or higher as well as the CSV frontend action.
- The Frontend User Manager requires Max or All Access as well as Use the Frontend User Manager.
- Join Codes are Max/All Access and still rely on an authorized create path plus their own code/Profile rules.
Recommended Test
- Create a dedicated non-administrator test account in the intended staff group.
- Open the unified Dashboard and note which tabs appear.
- Run one safe action that should be allowed.
- Confirm an intentionally withheld workflow does not become available merely because the menu page is visible.
- For Max User Manager roles, test both an allowed ordinary user and a protected administrative target.
Community Discussion
Want to compare Joomla user-management safeguards, share practical QCFUM configuration ideas, or discuss how other administrators delegate frontend workflows? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.