WP 5.5: Cannot attribute content when deleting users

[webzunft]

I am testing: 5.5-RC2-48740

The site has multiple users, all plugins are disabled. Theme is Twenty Nineteen

• go to Users
• enable the checkboxes next to 3 out of 4 existing users (except my own user)
• select "Delete" in the bulk actions and "Apply"
• select "Attribute all content to" + my user name
• click "Confirm Deletion"

I am now seeing: The link you followed has expired.

With Query Monitor is enabled I see a bit more:

This message was triggered by Core.

Call stack:

wp_die()
wp-includes/functions.php:3269
wp_nonce_ays()
wp-includes/pluggable.php:1154
check_admin_referer()
wp-admin/users.php:221

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the report.

I was able to reproduce the issue. It appears to only affect bulk actions:

• When clicking the Delete link for a particular user in the list table, it seems to work as expected.
• When doing the same with bulk actions, it displays "The link you followed has expired" message.

[SergeyBiryukov]

Introduced in [48134].

[SergeyBiryukov]

Also noting that the issue only affects the bottom bulk actions dropdown, the top one seems to work as expected.

[SergeyBiryukov]

#50987 was marked as a duplicate.

[garrett-eclipse]

Apply action="users.php" to the forms in users.php to nullify the action2/doaction2 params that get inherited from the URL when no action set on the form.

[garrett-eclipse]

Thanks for the report @webzunft I can confirm @SergeyBiryukov's note on this being "Introduced in [48134] / #46872."

Seems that change didn't get enough testing throughout as there's a few other reports.

Looking into this issue the introduction of the doaction2 param to the first request stays along for the ride when the second request to actually dodelete occurs as the form on that screen doesn't provide an action so inherits all current URL params in it's request.

To resolve this I've uploaded 46872.diff which updates the two forms in the users.php to provide an action referring to users.php without any params to avoid this param inheritance.

So far in my testing of the User Bulk Delete process it's working nicely, I'll look into the other occurrences to provide a more encompassing fix once I've identified all bulk-actions that are being affected. The fix for others should be the same just apply the current .php file as it's own action without any params.

CC @SergeyBiryukov / @desrosj / @johnbillion / @whyisjake - Can you test and feedback on this approach, I feel this is a candidate for 5.5.1.

[SergeyBiryukov]

Replying to garrett-eclipse:

So far in my testing of the User Bulk Delete process it's working nicely, I'll look into the other occurrences to provide a more encompassing fix once I've identified all bulk-actions that are being affected. The fix for others should be the same just apply the current .php file as it's own action without any params.

Thanks for the patch! Just noting that #50998 also seems related.

[SergeyBiryukov]

#51036 was marked as a duplicate.

[chunkysteveo]

Can confirm the same issue in same way as @SergeyBiryukov https://core.trac.wordpress.org/ticket/50882#comment:1

Adding in the patch action seems to fix my issue, and I am now able to delete multiple users again.

[audrasjb]

Hi there,

I tested @garrett-eclipse’s patch and it seems to fix the issue on my side.
Let's keep the needs-testing workflow keyword for now.
I'd also add high priority as this bug breaks an existing feature. This is a must-have for 5.5.1.

[SergeyBiryukov]

#51114 was marked as a duplicate.

[audrasjb]

As per today's bug scrub, the decision is to revert the changes done in changeset [48134] to fix the issue in WP 5.5.1 and to reopen the ticket to take another look and see how this can be fixed.

Same goes for #50998

[audrasjb]

Revert changeset 48134

[SergeyBiryukov]

In 48866:

Quick/Bulk Edit: Revert [48134] to address the bottom "Bulk actions" dropdown not functioning properly on Posts and Users list tables.

A better solution for the original issue will be explored in a future release.

Props audrasjb, garrett-eclipse, webzunft, Krstarica, chunkysteveo, SergeyBiryukov.
Fixes #50882, #50998. See #46872.

[SergeyBiryukov]

In 48867:

Quick/Bulk Edit: Revert [48134] to address the bottom "Bulk actions" dropdown not functioning properly on Posts and Users list tables.

A better solution for the original issue will be explored in a future release.

Props audrasjb, garrett-eclipse, webzunft, Krstarica, chunkysteveo, SergeyBiryukov.
Merges [48866] to the 5.5 branch.
Fixes #50882, #50998. See #46872.