What happened?

Banners do not respect the published state or access level of their primary category.

A banner is still displayed by the Banners module when its primary category is unpublished or inaccessible to the current user. Its direct click URL can also still be used: it redirects to the banner destination and increments the click count.

Version

5.4 / 6.2

Expected result

The banner must not be displayed when its primary category is unpublished or the current user does not have access to that category.

The direct click URL must not redirect or increment the banner click count in either case. It should return a 404 Not Found response.

Steps to reproduce

1. Create and publish a banner with a valid click URL.
2. Assign it to a published banner category.
3. Display the banner using the Banners module.
4. Use the banner direct click URL, for example:
   http://joomla.test/index.php/component/banners/click/1

Scenario 1: Category access

5. Set the banner’s primary category access level to Registered.
6. Visit the page and the direct click URL as a guest.

Scenario 2: Unpublished category

5. Unpublish the banner’s primary category.
6. Visit the page and open the same direct click URL.

Actual result

In both scenarios, the banner is still displayed by the Banners module.

The direct click URL redirects to the banner destination and increments the banner click count.