important security fix

now it's not allowed to mass-assign state for advertisement