[5.4] Add publishing checks to banner item retrieval

[nielsnuebel]

Pull Request resolves #46880

Summary of Changes

This PR enhances the getItem method in com_banners to include state and publishing date validation. By adding these conditions to the database query, we ensure that banner data (including the click URL) is only retrieved if the banner is currently active.

Technical Changes:

Added $nowDate using Factory::getDate()->toSql() for precise timing.

Extended the WHERE clause to check for state = 1.

Added logic to respect publish_up and publish_down fields (including NULL checks).

Testing Instructions

1. Identify a banner ID that is currently unpublished or expired.
2. Attempt to trigger a click via the standard routing: index.php?option=com_banners&task=click&id=[ID].
3. Before PR: The system still retrieves the banner object and increments the click counter.
4. After PR: The getItem method returns no result for inactive banners, effectively preventing the click-tracking task from executing.
5. Verify that published banners within their date range continue to track clicks correctly.

Actual result BEFORE applying this Pull Request

The getItem method retrieves banner details regardless of the publication status, allowing the click-tracking logic to increment counters for inactive ads. This results in "ghost clicks" visible in reporting tools like Looker Studio, where clicks are recorded despite 0 impressions.

Expected result AFTER applying this Pull Request

Banner data is only returned if the banner is published and within the valid date range. Inactive banners will no longer have their clicks tracked.

Link to documentations

• No documentation changes for guide.joomla.org needed
• No documentation changes for manual.joomla.org needed

[chmst]

How can inactive banners get cklicks?

[brianteeman]

How can inactive banners get cklicks?

from a page cache?

[nielsnuebel]

How can inactive banners get cklicks?

The primary issue is automated traffic from bots or crawlers (like Google or specialized bots) that still have old click-URLs in their index. Here is an example from my server logs:

13/Feb/2026:00:12:03 +0100] "GET /component/banners/click/288 HTTP/1.1" 404 5527 "-" "Mozilla/5.0 (compatible; FleebsBot/1~w; +https://fleebs.com/bot)" www.domain.tld

Why this fix is necessary:

Data Integrity: Currently, Joomla counts these as valid clicks if the ID exists, even if the banner is unpublished or expired. This leads to "ghost clicks" that skew reporting data.

Correct Response: With my fix, the system correctly validates the state and publishing dates within the getItem method. As seen in the log, the server now appropriately returns a 404 instead of processing an invalid interaction.

Returning a 404 is the correct technical response for a resource that is no longer "active" for the public, ensuring clean statistics and better resource management.

[tecpromotion]

Bug confirmed: The change fixes incorrect behavior where inactive banners were still processed (e.g., click tracking continued even when a banner was unpublished or expired).

[HLeithner]

You don't need to provide the same parameter twice.

[tecpromotion]

see https://github.com/joomla/joomla-cms/actions/runs/21989191781/job/63531371242?pr=46881

[ThomasFinnern]

I have tested this item ✅ successfully on 0fd57ff

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46881.}

Requested changes have been implemented.

[beni71]

I have tested this item ✅ successfully on 0fd57ff

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46881.}

[richard67]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46881.}