Severity: MEDIUM
Location: src/Models/BbsFavorite.php:63-79
Bug: Concurrent double-click leaves favorite in wrong state.
Fix: Single atomic path: INSERT IGNORE + rowCount check; if 0, DELETE.
Status: open. Will reply with remediation details when resolved.
Resolved.
BbsFavorite::toggle now uses INSERT IGNORE + rowCount() to decide atomically whether to create or delete (src/Models/BbsFavorite.php):
$stmt = $db->query('INSERT IGNORE INTO bbs_favorites ...');
if ($stmt->rowCount() === 1) return true; // we created it
$db->execute('DELETE FROM bbs_favorites ...'); return false;
No more SELECT→INSERT race. Double-click / two-tab toggle now lands in a consistent state: either both attempts pass the INSERT and the second one deletes (toggled off), or both DELETEs run and the entry is off. Either way the visible state matches the last click the user made.
Locking this thread.