Bulk Deleting Sites from Network Admin, No Confirmation message

[professor44]

When you delete a single site from /wp-admin/network/sites.php you're presented with the message "You are about to delete the site SITENAME" and you have to click "confirm" to complete the deletion of the site.

However, if you bulk delete sites (selecting 2 or more sites) from the same location you are not presented with a confirmation message. Instead, the sites immediately delete. This can be quite hazardous, especially if you're expecting to see a confirmation message.

[noam@…]

In the Multisite Network Admin (/wp-admin/network/sites.php), if you hover over a site and click, "Delete", the confirmation message successfully displays before the site is deleted.

However, if you use the Bulk Actions select menu to delete a site, there is no confirmation message. To be clear: there is no confirmation message when using Bulk Actions, regardless of if you are trying to delete a single site or multiple sites.

[tubiz]

Confirms all bulk actions (Delete, Mark as Spam and Not Spam)

Mark As Spam

Delete Sites

Mark as Not Spam

[ocean90]

Related: ticket:11183:1

[realloc]

The delete part of this report was resolved in 4.9 via #41177. wp-admin/network/sites.php now renders a confirmation screen for the bulk "Delete" action, listing the affected sites and requiring a separate delete_sites request with an ms-delete-sites nonce before anything is removed.

The only remaining part of the attached patch concerns the "Mark as Spam" and "Not Spam" bulk actions, which still run without confirmation. Since both are reversible from the same screen, a confirmation step there seems hard to justify, so I would not keep this ticket open for it.