Dear Thirdsun
I recently discovered this situation as well. When our event sold out I marked the online registration menu entry as unpublished and created a new item linked to an article saying that we were sold out. Much to my surprise someone still registered, but the email I got was "off" and when I checked Payments management, there was no record. I assumed the person had faked the email. Later when I looked at the actual payments table I found the record was there with an event code of 0. (Typical Tuan, he doesn't clean up the database.) So then I though the registrant had hacked my site. I found that I could alter the last number in the URL (the Joomla "item id" from the menu page) and a wierd version of the form came up. Then I recalled that I had created hyperlinks from other menu items to the registration form, and sure enough these were still going to the form. So I changed the item id ... and that didn't correct it. It wasn't until I used cut and paste on the complete, correct URL that I got it to branch to the correct menu item.
I think this is a Joomla issue. When you create a menu item, it "exists" and supports you as a developer being able to get to it to do modifications (development work). The publish/unpublish doesn't remove the code, it just attempts to disable it. Maybe Tuan didn't do it right, maybe this is a basic bug in Joomla. Someone can either blunder on to the correct URL, follow an old hyperlink, find it with a search engine, etc. and still get there. I set the security on the old page to "special" to make it hard for any but a small group to reach it and I made sure I didn't have any old hyperlinks that someone could easily click. The item still exists, and can still be reached under the right circumstances. I want to keep the page for my reference. To absolutely lock the door, you need to delete the page and empty the menu trash.
Regards,
Dave Sause
oldandfat@cox.net
