bug: onContentChangeState auto-post does not check for duplicate cross-posts #238

New Issue

2026-06-29T14:21:42Z

jmiller commented

2026-06-29 14:21:42 +00:00

Description

When articles are bulk-published via onContentChangeState, the handler calls CrossPostDispatcher::dispatch() for each article. While dispatch() has a duplicate guard that checks for existing queued/posted/posting entries, the onContentChangeState handler does not check post_on_first_publish_only.

Looking more carefully, line 516 does check auto_post_on_publish but does NOT check post_on_first_publish_only -- unlike onContentAfterSave at line 475 which does. This means:

User sets "Post on first publish only" = Yes
Article is published and cross-posted (correct)
Article is unpublished
Article is re-published via bulk state change
Article gets cross-posted AGAIN (wrong -- violates post_on_first_publish_only)

The duplicate guard in dispatch() catches queued/posted/posting status entries, but if the previous post was deleted (via delete-on-unpublish) or permanently_failed, the guard won't prevent a re-post.

Fix

Add post_on_first_publish_only check in onContentChangeState:

if ($params->get('post_on_first_publish_only', 0)) {
    // Check if this article has ever been cross-posted
    $existingCount = $db->setQuery(...)->loadResult();
    if ($existingCount > 0) continue;
}

Impact

Severity: Low -- only affects edge case of re-publishing + first-publish-only config
Affected file: source/packages/plg_content_mokosuitecross/src/Extension/MokoSuiteCrossContent.php
Affected method: onContentChangeState() (line 489)

## Description When articles are bulk-published via `onContentChangeState`, the handler calls `CrossPostDispatcher::dispatch()` for each article. While `dispatch()` has a duplicate guard that checks for existing `queued`/`posted`/`posting` entries, the `onContentChangeState` handler does not check `post_on_first_publish_only`. Looking more carefully, line 516 does check `auto_post_on_publish` but does NOT check `post_on_first_publish_only` -- unlike `onContentAfterSave` at line 475 which does. This means: 1. User sets "Post on first publish only" = Yes 2. Article is published and cross-posted (correct) 3. Article is unpublished 4. Article is re-published via bulk state change 5. Article gets cross-posted AGAIN (wrong -- violates `post_on_first_publish_only`) The duplicate guard in `dispatch()` catches `queued`/`posted`/`posting` status entries, but if the previous post was `deleted` (via delete-on-unpublish) or `permanently_failed`, the guard won't prevent a re-post. ## Fix Add `post_on_first_publish_only` check in `onContentChangeState`: ```php if ($params->get('post_on_first_publish_only', 0)) { // Check if this article has ever been cross-posted $existingCount = $db->setQuery(...)->loadResult(); if ($existingCount > 0) continue; } ``` ## Impact - **Severity**: Low -- only affects edge case of re-publishing + first-publish-only config - **Affected file**: `source/packages/plg_content_mokosuitecross/src/Extension/MokoSuiteCrossContent.php` - **Affected method**: `onContentChangeState()` (line 489)

jmiller commented

2026-06-29 14:21:45 +00:00

Branch created: feature/238-bug-oncontentchangestate-auto-post-does-

git fetch origin
git checkout feature/238-bug-oncontentchangestate-auto-post-does-

Branch created: [`feature/238-bug-oncontentchangestate-auto-post-does-`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteCross/src/branch/feature/238-bug-oncontentchangestate-auto-post-does-) ```bash git fetch origin git checkout feature/238-bug-oncontentchangestate-auto-post-does- ```

jmiller referenced this issue from a commit

2026-06-29 16:28:16 +00:00

fix: resolve 10 critical/medium bugs from deep dive audit

jmiller referenced this issue

2026-06-29 16:28:52 +00:00

fix: resolve 10 critical/medium bugs from deep dive audit #252

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteCross#238