[6.2] Fix unpublished articles preview

[CSGoat0]

Pull Request resolves #47370

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This PR implements a secure, time-limited token-based preview system that allows administrators to preview articles regardless of their publishing date or published state, even when "Shared Sessions" is disabled in Global Configuration.

Key changes:

1. Added a new database table #__content_preview_tokens to store preview tokens with expiration
2. Modified the preview link generation in the admin article view to include &preview=1 and a unique token
3. Added isAdminPreview() validation method in the frontend ArticleModel to verify valid preview requests
4. Bypassed publishing date and state filters for authenticated preview requests

Testing Instructions

Prerequisites:

• Joomla installation with "Shared Sessions" disabled (Global Configuration → System → Session Settings → Shared Sessions = No)
• A user account with administrator privileges
• After applying the PR, navigate to System -> Maintenance -> Database. Select the 6.2.0-2026-04-11 Database Version and click Update Structure. Otherwise, you will get 1146 Table 'lights_db.j62a1_content_preview_tokens' doesn't exist

Test Scenario 1: Future-dated article preview

1. Create a new article with "Start Publishing" set to tomorrow's date
2. Click the Preview button from the article edit form

Test Scenario 2: Unpublished article preview

1. Create a new article and set its state to "Unpublished"
2. Click the Preview button from the article edit form

Actual result BEFORE applying this Pull Request

When "Shared Sessions" is disabled:

• Clicking Preview on a future-dated article displays a 404 - Article not found error
• Clicking Preview on an unpublished article displays a 404 - Article not found error
• Administrators must enable "Shared Sessions" for preview to work, which is not ideal for security-conscious sites

Expected result AFTER applying this Pull Request

When "Shared Sessions" is disabled:

• Clicking Preview on a future-dated article displays the article preview correctly
• Clicking Preview on an unpublished article displays the article preview correctly
• Security is maintained through time-limited, cryptographically secure tokens tied to user permissions

Implementation Details

1. New Database Table (#__content_preview_tokens)

CREATE TABLE IF NOT EXISTS `#__content_preview_tokens` (
    `id`         INT(11)      NOT NULL AUTO_INCREMENT,
    `token`      VARCHAR(64)  NOT NULL,
    `user_id`    INT(11)      NOT NULL,
    `article_id` INT(11)      NOT NULL,
    `expires`    DATETIME     NOT NULL,
    PRIMARY KEY (`id`),
    UNIQUE KEY `idx_token` (`token`),
    KEY `idx_article` (`article_id`),
    KEY `idx_expires` (`expires`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 DEFAULT COLLATE=utf8mb4_unicode_ci;

2. Token Generation (administrator/components/com_content/src/View/Article/HtmlView.php)

• Generates a cryptographically secure 32-character hex token using random_bytes(16)
• Token expires after 5 minutes (sufficient for preview, limits replay attacks)
• Automatically cleans up expired tokens from the database
• Appends &preview=1&preview_token={token} to both standard preview and accessibility (jooa11y) preview links

3. Token Validation (components/com_content/src/Model/ArticleModel.php)

• Checks for preview=1 parameter in the request
• Validates the token exists in the database, matches the article ID, and is not expired
• Verifies the user associated with the token has core.edit.state permission
• Returns true only if all validation passes

4. Filter Bypass Logic

• Date filters (publish_up/publish_down) are skipped when isAdminPreview() returns true
• State filters (published/unpublished) are skipped when isAdminPreview() returns true
• Post-query state validation is skipped when isAdminPreview() returns true

Security Considerations

Attack Vector	Mitigation
Token guessing	128-bit entropy (2^128 possibilities) makes brute force infeasible
Token interception	5-minute expiration limits the attack window
Token replay	Expired tokens are deleted; each preview generates a new token
Unauthorized user	Token is tied to the generating user's ID and requires core.edit.state permission
Shared links	Users without edit permissions cannot use another user's preview token

Additional Notes

Testing performed:

• ✅ Future-dated article preview works with Shared Sessions disabled
• ✅ Unpublished article preview works with Shared Sessions disabled
• ✅ Expired tokens correctly return 404
• ✅ Regular frontend article access unaffected (regression test passed)
• ✅ Accessibility check (jooa11y) is working now for unpublished Articles

Database installation:
The table creation query was tested via phpMyAdmin on an existing Joomla installation.

Note on branch targeting:
I understand that bug fixes are typically made against the 5.4 branch, while new features target 6.2. However, since my solution introduces a new database table and implements a token-based preview system (which adds new functionality to the core), I believe this could be a feature rather than a pure bug fix. Therefore, I have developed this against the 6.2 branch. If the maintainers prefer this to be backported or handled differently, I'm happy to adjust accordingly.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:
• No documentation changes for guide.joomla.org needed
• Pull Request link for manual.joomla.org:
• No documentation changes for manual.joomla.org needed

[brianteeman]

As you can see from the test this breaks on postgres as you have only updated the installation sql for mysql - you need to do the same change for postgres

You also need to have update sql for existing installations

[CSGoat0]

As you can see from the test this breaks on postgres as you have only updated the installation sql for mysql - you need to do the same change for postgres

You also need to have update sql for existing installations

Hello, thanks for the help!
I have just updated postgresql and sql for existing installations.

[brianteeman]

Accessibility check (jooa11y) is not currently working with the same token mechanism, if this PR is accepted I might follow up with another PR to solve its issue.

That would need to be fixed with this issue

[CSGoat0]

Accessibility check (jooa11y) is not currently working with the same token mechanism, if this PR is accepted I might follow up with another PR to solve its issue.

That would need to be fixed with this issue

Hello, I found out that accessibility check is not working at 6.2 dev.
The 404 error appears using the original code even at published articles. If it is supposed to work, then probably latest updates broke it.

When I was tracing I found an error Dispatcher not set in Joomla\CMS\Plugin\CMSPlugin, it's because of Deprecated getDispatcher(), when I changed it I found another error and so on.

[CSGoat0]

That would need to be fixed with this issue

Hello, could you please confirm if the accessibility check is not working as it is for me now? (please check my last comment).
If yes, should I try to fix it in this pr? I just thought it would be a little bit out of scope for this issue. I can work on it, but I don't know if this would be correct. So, I am waiting for directions.

[brianteeman]

the jooa11y error was unrelated to the changes here and is fixed with #47579

[brianteeman]

I will leave it to others with more architecture experience to comment on the code.

From a user experiece this works well and is a good and useful addition to Joomla

[CSGoat0]

I will leave it to others with more architecture experience to comment on the code.

From a user experiece this works well and is a good and useful addition to Joomla

Thanks! I appreciate that.
Happy to work with Joomla!

I have also fixed another bug yesterday
and made a new PR. I will appreciate feedback.

[exlemor]

I have tested this item 🔴 unsuccessfully on 8e6789b

During Friday May 1st, PR testing session, I was able to replicate BEFORE condition.

Unfortunately, after applying Patch, and trying to test Scenario 1, I get a Joomla crash/error:

An error has occurred.
1146 Table 'lights_db.j62a1_content_preview_tokens' doesn't exist
Return to Dashboard

Mentioned to Abdelrahman.

Screenshot:

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47569.}

[CSGoat0]

I have tested this item 🔴 unsuccessfully on 8e6789bDuring Friday May 1st, PR testing session, I was able to replicate BEFORE condition.

Unfortunately, after applying Patch, and trying to test Scenario 1, I get a Joomla crash/error:

An error has occurred. 1146 Table 'lights_db.j62a1_content_preview_tokens' doesn't exist Return to Dashboard

Mentioned to Abdelrahman.

Yes, you are right. It is because I created the table manually as i've mentioned in the pr.

didn't test it without the table back then, but now i tried it now and it doesn't work.
I will try to fix it. Thanks @exlemor for the test and looking forward for another one after fixing this issue.😄

[CSGoat0]

@exlemor Hi, It seems like we had to update structure at System -> Maintenance -> Database.
Didn't know that because I created the table manually. Now I've updated the Instructions.
I am looking forward for another test.
Thanks!

[CSGoat0]

Update, Accessibility check (jooa11y) is now working perfectly for unpublished Articles✅.

[ThomasFinnern]

I have tested this item ✅ successfully on caa1fe7

i tested both scenarios and the error w2as gone and the article was displayed in "Preview"

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47569.}

[alikon]

imho
there should be a cleanup of already expired records from the new table, otherwise it will grow

[CSGoat0]

imho there should be a cleanup of already expired records from the new table, otherwise it will grow

At every new record, the old one is cleaned up.

[joomdonation]

There are few things which we need to decide:

• The token expiration time should be configurable
• We need to decide if using table to store token is really needed. Or we can have a simpler mechanism like just use a Json web token to generate the token and use it for validation. If use table, do we need to have a scheduled task to clean up expired token automatically (right now, there is code to clean up when article is edited in backend, but there is always token left in the table - for example, if the article is not edited anymore)
• The isAdminPreview method access to application input to determine if it is a preview and it is not very nice. Maybe we should introduce a model state and populate that state in populateState method instead

This should be discussed by maintainers for further improvements to current code. As this current state, the PR could not be merged.

[CSGoat0]

@joomdonation for every new token generated (regardless of which article), all expired tokens in the table
are cleaned up at that point - so stale rows don't accumulate as long as previews keep happening
somewhere on the site. I don't think a scheduler is needed for that reason.

About the expiration time, I'm fine adding whatever value is agreed on. I'm just not sure how you'd
like it to be configurable - e.g. a global setting in com_content's options, or something else you
had in mind?

That's what I have in mind for these two points for now.

[joomdonation]

• About clean up expired token: As mentioned, with the current implement, there is always expired token left for each article in the database and there is no way to have it clean up completely. I also do not really like mixing token generation and clean up in the same method, so I would say having a scheduled task to clean up (if we decide to use database table for storing token) would be better
• About configuring token expiration time: Yes, It should be a new config option in com_content's options.

Are you open for an alternative implementation which does not require storing tokens in database table as I mentioned earlier? If Yes, maybe we can find sometime to chat about it on Mattermost.

[CSGoat0]

@joomdonation, of course!
I agree your suggestions are a lot better.

[QuyTon]

Alternative PR #48030.

[joomdonation]

Hi @CSGoat0

This PR does not need/ should not be closed because there is no final decision yet. I prefer the alternative PR because it is simpler, does not need extra database table but your PR is also a good one(although it is not yet completed). We can have two PRs open and maintainers will make final decision.