Exclude the Current Frontend Manager and Administrator Notification Recipients

QCFUM 2.0.4 includes two Frontend User Manager safeguards that are enabled by default: exclude the logged-in frontend manager from managing their own account, and exclude configured administrator-notification recipients from delegated management.

The Two Safeguards

Open Components > QC Frontend User Manager > Settings > Frontend User Manager Settings.

  • Exclude current frontend manager from results protects the account that is currently signed in.
  • Exclude admin notification recipients protects users whose email address matches a configured QCFUM administrator-notification recipient.

How Current-Manager Exclusion Works

When enabled, QCFUM compares the target Joomla user ID with the current frontend manager’s user ID. A match makes the target protected. This prevents a delegated manager from using the Frontend User Manager to change their own identity, groups, password state, account status, or other managed-user actions.

How Administrator-Recipient Exclusion Works

When enabled, QCFUM loads the configured administrator recipient email addresses and compares them with the target user’s email address. A matching user is treated as protected.

This safeguard follows the configured QCFUM notification-recipient list. If an administrator’s address changes, update the notification configuration as well as Joomla so the protection still matches the intended account.

These Controls Are Additional Layers

Disabling either checkbox does not turn off QCFUM’s other protections. A target may still be protected because of a specific excluded user ID, a protected group, or administrative capabilities such as core.admin, core.login.admin, or core.manage.

Verify the Configuration

  1. Leave both safeguards enabled unless there is a documented reason not to.
  2. Sign in as a non-Super-User frontend manager.
  3. Confirm that manager cannot select their own account for delegated management.
  4. Confirm a Joomla user whose email matches an administrator-notification recipient is also excluded.
  5. Confirm a normal allowed target remains available so you know the result is protection, not a broken Frontend User Manager configuration.

Recommended Production Position

For most sites, keep both controls enabled. Self-management and notification-recipient accounts are high-value targets, and there is little benefit in exposing them to delegated account administration.

Community Discussion

Want to compare Joomla user-management safeguards, share practical QCFUM configuration ideas, or discuss how other administrators delegate frontend workflows? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.