Pull Request resolves #48294.

This is the 5.4 version of PR #48296, which targets 6.2-dev.

I am opening this against 5.4 because the bug also exists in the current 5.4 branch and the fix is small, self-contained, and backward-compatible. Getting it merged in 5.4 first allows the fix to be available sooner in the next 5.4 patch release and then forward-merged through the usual Joomla release branches.

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Fixes banners being displayed and opened when their category is unpublished or inaccessible to the current user.

The Banners module now filters banners by the published state and access level of their category. The direct banner click endpoint applies the same checks, so unavailable banners cannot redirect users or increment click counts.

The banner click cache key now includes the current user's authorised view levels, so cached banner results are not shared across users with different access.

Testing Instructions

1. Create and publish a banner with a valid click URL.
2. Assign it to a published banner category and display it with the Banners module.
3. Confirm the banner is displayed and its direct click URL works.
4. Set the category access to Registered.
5. Visit the page and direct click URL as a guest.
   • The banner must not be displayed.
   • The direct click URL must return 404 and not increment clicks.
6. Repeat steps 4-5 after unpublishing the category.

Actual result BEFORE applying this Pull Request

Banners are displayed by the Banners module even when their category is unpublished or inaccessible to the current user.

The direct banner click URL also redirects to the destination and increments the click count in both cases.

Expected result AFTER applying this Pull Request

Banners are not displayed when their primary category is unpublished or inaccessible to the current user.

The direct banner click URL returns a 404 response and does not increment the click count.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed