How QCLF Keeps Search Private and Permission-Aware

QCLF builds Search from the current visitor’s accessible Sections and Categories before result counting and pagination. Inaccessible structure is not merely hidden after the query—it is excluded from the searchable category ID set.

The search query then applies publication, approval, deletion, reveal-time, and Message-state rules before producing counts or rows.

Access Scope Is Built First

Search starts with the same published Section/Category loaders used for browsing. When the permission service is available, canViewSection() and canViewCategory() remove inaccessible structure before the search query receives its Category IDs.

The Section/Category filter dropdowns are built from that same scope.

Topic Visibility Rules

• Topic is not soft-deleted.
• Topic approval state is approved.
• Topic state is published or archived.
• Parent Category and Section are published.
• Topic belongs to a Category ID already approved for the visitor’s scope.
• Future reveal time is respected for live Topic visibility.

Message Visibility Rules

Message results inherit the Topic/Category/Section restrictions above and additionally require the reply to be approved, not marked deleted, and to have no deletion timestamp.

That prevents a deleted or pending Message from leaking through result excerpts or counts.

Counts and Pagination Use the Filtered Union

QCLF builds the permitted Topic query and permitted Message query first, unions them, and then runs COUNT(*) on that union. Pagination and final result rows use the same filtered union.

Because filtering happens before the count, an inaccessible hit does not reveal itself as an unexplained extra result/page count.

Direct Filter Tampering Fails Closed

A requested Section or Category must exist in the current search scope. If it does not, or if the requested Category is not inside the requested Section, search returns an empty Category ID list and therefore zero rows.

Community Discussion

Want to compare forum workflows, share practical QCLF tips, or discuss how other Joomla site owners use this feature? Visit the QC Live Forum Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.