[8.x-1.x] Bulk Batch Delete

Thank you for applying!

Please read Review process for security advisory coverage: What to expect → for more details and Security advisory coverage application checklist → to understand what reviewers look for. Tips for ensuring a smooth review → gives some hints for a smother review.

The important notes are the following.

• If you have not done it yet, you should run phpcs --standard=Drupal,DrupalPractice on the project, which alone fixes most of what reviewers would report.
• For the time this application is open, only your commits are allowed.
• The purpose of this application is giving you a new drupal.org role that allows you to opt projects into security advisory coverage, either projects you already created, or projects you will create. The project status won't be changed by this application and no other user will be able to opt projects into security advisory policy.
• We only accept an application per user. If you change your mind about the project to use for this application, please update the issue summary to give the link to the correct project link and the issue title to contain that project name.

To the reviewers

Please read How to review security advisory coverage applications → , What to cover in an application review → , and Drupal.org security advisory coverage application workflow → .
Reviewers only describe what needs to be changed; they don't provide patches to fix what reported in a review.

1. Fix phpcs issues.

phpcs --standard=Drupal,DrupalPractice --extensions=php,module,inc,install,test,profile,theme,css,info,txt,md,yml bulkbatchdelete/

FILE: bulkbatchdelete/bulkbatchdelete.install
--------------------------------------------------------------------------------
FOUND 3 ERRORS AFFECTING 3 LINES
--------------------------------------------------------------------------------
  6 | ERROR | [x] There must be exactly one blank line after the file comment
  7 | ERROR | [x] There must be one blank line after the last USE statement; 0 found;
 10 | ERROR | [x] There must be no blank lines after the function comment
--------------------------------------------------------------------------------
PHPCBF CAN FIX THE 3 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------


FILE: bulkbatchdelete/bulkbatchdelete.module
--------------------------------------------------------------------------------
FOUND 12 ERRORS AFFECTING 6 LINES
--------------------------------------------------------------------------------
 20 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 20 | ERROR | [x] Line indented incorrectly; expected 6 spaces, found 3
 21 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 21 | ERROR | [x] Line indented incorrectly; expected 6 spaces, found 3
 22 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 22 | ERROR | [x] Line indented incorrectly; expected 6 spaces, found 3
 23 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 23 | ERROR | [x] Line indented incorrectly; expected 6 spaces, found 3
 24 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 24 | ERROR | [x] Line indented incorrectly; expected 6 spaces, found 3
 25 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 25 | ERROR | [x] Case breaking statement indented incorrectly; expected 6 spaces, found 3
--------------------------------------------------------------------------------
PHPCBF CAN FIX THE 12 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------


FILE: bulkbatchdelete/drush.services.yml
------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
------------------------------------------------------------------------
 6 | ERROR | [x] Expected 1 newline at end of file; 0 found
------------------------------------------------------------------------
PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY
------------------------------------------------------------------------


FILE: bulkbatchdelete/README.md
----------------------------------------------------------------------
FOUND 0 ERRORS AND 2 WARNINGS AFFECTING 2 LINES
----------------------------------------------------------------------
  8 | WARNING | Line exceeds 80 characters; contains 93 characters
 16 | WARNING | Line exceeds 80 characters; contains 91 characters
----------------------------------------------------------------------


FILE: bulkbatchdelete/src/Commands/BulkUserDeleteCommands.php
--------------------------------------------------------------------------------
FOUND 11 ERRORS AND 4 WARNINGS AFFECTING 14 LINES
--------------------------------------------------------------------------------
   1 | ERROR   | [x] The PHP open tag must be followed by exactly one blank line
   6 | ERROR   | [x] There must be one blank line after the last USE statement; 0 found;
  39 | ERROR   | [x] Expected 1 blank line before function; 0 found
  42 | ERROR   | [x] Expected 1 blank line after function; 0 found
  50 | ERROR   | [ ] Parameter tags must be grouped together in a doc comment
  53 | ERROR   | [x] Whitespace found at end of line
  54 | ERROR   | [ ] Parameter tags must be grouped together in a doc comment
  58 | ERROR   | [ ] Parameter tags must be grouped together in a doc comment
  61 | ERROR   | [x] Whitespace found at end of line
  71 | WARNING | [ ] Line exceeds 80 characters; contains 82 characters
  72 | WARNING | [ ] \Drupal calls should be avoided in classes, use dependency injection instead
  78 | WARNING | [ ] Unused variable $num_operations.
 103 | WARNING | [ ] t() calls should be avoided in classes, use \Drupal\Core\StringTranslation\StringTranslationTrait and $this->t() instead
 116 | ERROR   | [x] Expected 1 newline at end of file; 0 found
 116 | ERROR   | [x] The closing brace for the class must have an empty line before it
--------------------------------------------------------------------------------
PHPCBF CAN FIX THE 8 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------


FILE: bulkbatchdelete/src/Form/BatchCreationForm.php
--------------------------------------------------------------------------------
FOUND 30 ERRORS AND 8 WARNINGS AFFECTING 31 LINES
--------------------------------------------------------------------------------
   1 | ERROR   | [x] The PHP open tag must be followed by exactly one blank line
  25 | ERROR   | [x] Whitespace found at end of line
  26 | ERROR   | [x] Additional blank lines found at end of doc comment
  33 | ERROR   | [x] Whitespace found at end of line
  34 | ERROR   | [x] Additional blank lines found at end of doc comment
  76 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
  83 | ERROR   | [x] Short array syntax must be used to define arrays
  94 | WARNING | [ ] Line exceeds 80 characters; contains 83 characters
 103 | WARNING | [x] A comma should follow the last multiline array item. Found: true
 103 | ERROR   | [x] TRUE, FALSE and NULL must be uppercase; expected "TRUE" but found "true"
 121 | ERROR   | [x] Whitespace found at end of line
 138 | ERROR   | [x] Whitespace found at end of line
 148 | ERROR   | [x] Short array syntax must be used to define arrays
 149 | ERROR   | [x] Inline comments must start with a capital letter
 149 | ERROR   | [x] Comments may not appear after statements
 168 | WARNING | [ ] #description values usually have to run through t() for translation
 171 | ERROR   | [x] Short array syntax must be used to define arrays
 172 | ERROR   | [x] Inline comments must start with a capital letter
 172 | ERROR   | [x] Comments may not appear after statements
 194 | WARNING | [ ] Line exceeds 80 characters; contains 82 characters
 195 | ERROR   | [x] Expected 1 space after IF keyword; 0 found
 198 | ERROR   | [x] Concat operator must be surrounded by a single space
 198 | ERROR   | [x] Concat operator must be surrounded by a single space
 198 | ERROR   | [x] Concat operator must be surrounded by a single space
 198 | ERROR   | [x] Concat operator must be surrounded by a single space
 203 | ERROR   | [x] Concat operator must be surrounded by a single space
 207 | ERROR   | [x] Whitespace found at end of line
 228 | WARNING | [ ] Line exceeds 80 characters; contains 81 characters
 281 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
 283 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
 285 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
 287 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
 292 | WARNING | [ ] Line exceeds 80 characters; contains 83 characters
 301 | WARNING | [x] There must be no blank line following an inline comment
 301 | WARNING | [ ] There must be no blank line following an inline comment
 307 | ERROR   | [x] Whitespace found at end of line
 308 | ERROR   | [x] Expected 1 blank line after function; 0 found
 309 | ERROR   | [x] The closing brace for the class must have an empty line before it
--------------------------------------------------------------------------------
PHPCBF CAN FIX THE 32 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------


FILE: bulkbatchdelete/src/Service/BatchService.php
--------------------------------------------------------------------------------
FOUND 98 ERRORS AND 3 WARNINGS AFFECTING 86 LINES
--------------------------------------------------------------------------------
   1 | ERROR   | [x] The PHP open tag must be followed by exactly one blank line
   7 | WARNING | [x] Unused use statement
   7 | ERROR   | [x] When importing a class with "use", do not include a leading \
  11 | WARNING | [ ] The class short comment should describe what the class does and not simply repeat the class name
  15 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
  16 | ERROR   | [x] Expected 1 space(s) before asterisk; 0 found
  17 | ERROR   | [x] Expected 1 space(s) before asterisk; 0 found
  18 | ERROR   | [x] Expected 1 space(s) before asterisk; 0 found
  18 | ERROR   | [x] Expected "\Drupal\bulkbatchdelete\Service\ProcessEntity" but found "\Drupal\bulkbatchdelete\Service\ProcessEntity;" for @var tag in member
     |         |     variable comment
  19 | ERROR   | [x] Expected 1 space(s) before asterisk; 0 found
  22 | ERROR   | [x] Missing function doc comment
  23 | ERROR   | [x] Opening brace should be on the same line as the declaration
  27 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
  39 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
  49 | ERROR   | [x] Parameter comment indentation must be 3 spaces, found 2 spaces
  51 | ERROR   | [ ] Description for the @return value is missing
  53 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
  53 | ERROR   | [x] Visibility must be declared on method "generateQuery"
  55 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  56 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  57 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  58 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  60 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  61 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  62 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  63 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  63 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
  64 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  64 | ERROR   | [x] Expected 1 space after IF keyword; 0 found
  65 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
  66 | ERROR   | [x] Line indented incorrectly; expected 8 spaces, found 6
  67 | ERROR   | [x] Line indented incorrectly; expected 10 spaces, found 8
  68 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
  69 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
  70 | ERROR   | [x] Line indented incorrectly; expected 8 spaces, found 6
  71 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  71 | ERROR   | [x] Expected newline after closing brace
  71 | ERROR   | [x] Use "elseif" in place of "else if"
  71 | ERROR   | [x] Expected 1 space after IF keyword; 0 found
  74 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  74 | ERROR   | [x] Expected newline after closing brace
  74 | ERROR   | [x] Use "elseif" in place of "else if"
  74 | ERROR   | [x] Expected 1 space after IF keyword; 0 found
  77 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  78 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  79 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  80 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  81 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
  82 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
  83 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
  84 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
  85 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
  87 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
  90 | ERROR   | [x] Doc comment star missing
  91 | ERROR   | [x] There must be exactly one blank line before the tags in a doc comment
  98 | ERROR   | [x] Parameter comment indentation must be 3 spaces, found 2 spaces
 100 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
 102 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 103 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 104 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 105 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 106 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 107 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 108 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 109 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
 110 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
 111 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
 112 | ERROR   | [x] Line indented incorrectly; expected 6 spaces, found 4
 120 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 121 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 126 | ERROR   | [x] Line indented incorrectly; expected 4 spaces, found 2
 127 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
 129 | ERROR   | [x] Line indented incorrectly; expected 2 spaces, found 0
 135 | ERROR   | [x] Whitespace found at end of line
 141 | ERROR   | [x] Parameter comment indentation must be 3 spaces, found 2 spaces
 145 | ERROR   | [x] Additional blank lines found at end of doc comment
 161 | WARNING | [ ] Unused variable $myfile.
 174 | ERROR   | [x] Whitespace found at end of line
 185 | ERROR   | [ ] Type hint "array" missing for $results
 185 | ERROR   | [ ] Type hint "array" missing for $operations
 196 | ERROR   | [ ] Parameter $dataToGenerateQuery is not described in comment
 199 | ERROR   | [x] Doc comment long description must end with a full stop
 200 | ERROR   | [x] Whitespace found at end of line
 204 | ERROR   | [ ] Parameter comment must start with a capital letter
 204 | ERROR   | [x] Parameter comment must end with a full stop
 205 | ERROR   | [ ] Doc comment for parameter $id does not match actual variable name $dataToGenerateQuery
 206 | ERROR   | [ ] Parameter comment must start with a capital letter
 206 | ERROR   | [x] Parameter comment must end with a full stop
 208 | ERROR   | [x] Additional blank lines found at end of doc comment
 209 | ERROR   | [ ] Expected type hint "string"; found "int" for $id
 210 | ERROR   | [x] Opening brace should be on the same line as the declaration
 214 | ERROR   | [x] Case breaking statements must be followed by a single blank line
 217 | ERROR   | [x] Case breaking statements must be followed by a single blank line
 228 | ERROR   | [x] Opening brace should be on the same line as the declaration
 239 | ERROR   | [x] Opening brace should be on the same line as the declaration
 242 | ERROR   | [x] Whitespace found at end of line
 250 | ERROR   | [x] Opening brace should be on the same line as the declaration
 251 | ERROR   | [x] Namespaced classes/interfaces/traits should be referenced with use statements
 252 | ERROR   | [x] Expected 1 space after IF keyword; 0 found
 256 | ERROR   | [x] Expected 1 newline at end of file; 0 found
 256 | ERROR   | [x] The closing brace for the class must have an empty line before it
--------------------------------------------------------------------------------
PHPCBF CAN FIX THE 91 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------


FILE: bulkbatchdelete/src/Service/ProcessEntity.php
--------------------------------------------------------------------------------
FOUND 19 ERRORS AND 4 WARNINGS AFFECTING 22 LINES
--------------------------------------------------------------------------------
   1 | ERROR   | [x] The PHP open tag must be followed by exactly one blank line
   6 | WARNING | [x] Unused use statement
  10 | WARNING | [ ] The class short comment should describe what the class does and not simply repeat the class name
  12 | ERROR   | [x] Opening brace should be on the same line as the declaration
  28 | ERROR   | [x] Opening brace should be on the same line as the declaration
  36 | ERROR   | [x] Opening brace should be on the same line as the declaration
  52 | ERROR   | [ ] Doc comment short description must be on a single line, further text should be a separate paragraph
  55 | ERROR   | [x] Opening brace should be on the same line as the declaration
  60 | WARNING | [x] A comma should follow the last multiline array item. Found: 'taxonomy_term'
  68 | ERROR   | [ ] Missing short description in doc comment
  70 | ERROR   | [x] Parameter comment indentation must be 3 spaces, found 4 spaces
  70 | ERROR   | [ ] Parameter comment must start with a capital letter
  72 | ERROR   | [ ] Description for the @return value is missing
  73 | ERROR   | [x] Whitespace found at end of line
  74 | ERROR   | [x] Additional blank lines found at end of doc comment
  76 | ERROR   | [x] Opening brace should be on the same line as the declaration
  91 | ERROR   | [x] Opening brace should be on the same line as the declaration
  92 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
 105 | ERROR   | [x] Opening brace should be on the same line as the declaration
 106 | ERROR   | [x] Inline comments must end in full-stops, exclamation marks, question marks, colons, or closing parentheses
 111 | WARNING | [x] A comma should follow the last multiline array item. Found: 'Delete the account and its content. This action cannot be undone.'
 120 | ERROR   | [x] Opening brace should be on the same line as the declaration
 129 | ERROR   | [x] Expected 1 blank line after function; 2 found
--------------------------------------------------------------------------------
PHPCBF CAN FIX THE 18 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------

2. FILE: bulkbatchdelete.info.yml

package: Custom

Modules should avoid using that value for the package.

3. FILE: src/Form/BatchCreationForm.php

    // print_r($dataToGenerateQuery);
    // exit;

Remove commented debug code.

This issue has been assigned to a person for a reason.

@apaderno Apologises. I didn’t see that it was assigned.

Picking this one up as well. (ideally today)

Hey Velocity29,

Not a requirement, but just trying to help. We can't all be native speakers right. I've a proposal for a rewritten description on the module page:

Overview

The bulk batch delete is a module which helps you to delete users, content or taxonomies in bulk. It comes with very simple form where you can select which bundle you want to delete the content from. You can also add a custom description so the log reflects the action taken.

After submitting the form the chosen entities will be deleted.

Features

Quantity – Option to select number of entities to delete.
Tracking & No log burden on DB – Logs will get written into a file instead of DB.

I'd also mention the functionality that is available in the drush command.

For the review:
Similar modules:
Similar functionality could be achieved by using Views Bulk operations. Maybe it's interesting to let possible users know what's the advantage of using your module instead of building it using Views Bulk operations.

It might also be interesting to see if you can help this module with a Drupal 9/10 version instead of starting your own project: https://www.drupal.org/project/bulkdelete →

Maybe also see what is different enough about your module as opposed to this one: https://www.drupal.org/project/delete_all → (it looks like this module does a lot similar and has a lot of sites using it as well)

Manual review

1. Likely security issue with the permission on the route. Currently "access content" is used to allow access to the deletion form. This permission is easily given to anonymous users (see standard install profile https://git.drupalcode.org/project/drupal/-/blob/10.1.x/core/profiles/st...). So that means this would allow an anonymous user to delete all content on your site.

2. Your composer file might have some issues:

• I think your package name should be: drupal/bulkbatchdelete
• It's now defined as drupal-drush but it's mainly described as a Drupal module
• You must enter license as GPL-2.0-or-later when hosting on Drupal.org

See: https://www.drupal.org/docs/develop/creating-modules/add-a-composerjson-... →

3. Not a requirement, but it would make more sense to have a link to this form in the content section instead of the /admin/config/system.

4. Very debatable, but having the log files stores in a public directory, might lead to a security issue. A malicious actor having access to these logs could help with enumeration of user ids and could help in subsequent attacks. But as i said very debatable. My suggestion would be to have the option to: use the default logging of Drupal (which can go to db or syslog) or have the choice of where to store these files. (private or public)

5. Readme file is not following standards. See: https://www.drupal.org/docs/develop/managing-a-drupalorg-theme-module-or... →

6. Feedback on: BulkUserDeleteCommands.php

• Seems to have a lot of comments that come from boilerplate generators, this adds very little value to the developer reading the code as it's not really relevant for the functionality
• It seems very arbitrary to only delete active users from a certain role. I'd expect all user to be deleted. Or at least be given the option to choose by way of a parameter.

7. Feedback on: BatchCreationForm.php

• Seems to have some comments that come from boilerplate generators, this adds very little value to the developer reading the code as it's not really relevant for the functionality
• I also seem some comments that don't seem to be adapted from the original purpose of this module. It looks like this was originally only to delete users in bulk not multiple entity types.
• Ideally someone can help you fix the grammar on the descriptions. Not a requirement, but a nice to have.
• It's an interesting approach to creating the options for the select list with ajax. I think you might run into possible security issue as Drupal can't validate if those values are within the range it can expect. For a dynamic select list with ajax I'd like to point you to: https://git.drupalcode.org/project/examples/-/blob/4.0.x/modules/ajax_ex...
• You've added a lot of custom validation which could be handled with the #required parameter on the form elements. You might want to have a look here on how to bypass the required issue when using ajax: https://www.drupal.org/project/drupal/issues/2476569 →

8. Feedback on: /src/Service/ProcessEntity.php

• A nice to have would again be a grammar thing here: use entity instead of entitie
• The methods to get the options for the select lists don't allow the labels to be translated. e.g. Blocked should be wrapped in a translation function: https://www.drupal.org/docs/8/api/translation-api/overview →
• I think you could also get the options for getListOfCancelMethod from the original list in core instead of hardcoding it here. If core changes something your code will still be in sync. See user_cancel_methods() in user.module

9. Feedback on: src/Service/BatchService.php

• It's a bit confusing that the variable node_type_list is being used for bundles and roles at the same time.
• Not sure why the debug tag remains on the query. I would remove it.
• A nice to have: Dependency injection in the batchoperation as per the example here: https://www.previousnext.com.au/blog/refactoring-drupal-batch-api-callba... as we are blocked doing it the normal way here: https://www.drupal.org/project/drupal/issues/2875151 →

Skipping the automated review as Vishal already mentioned them above.

Hi nielsaers,

Thanks for all the suggestion, I am working on it.

I am changing priority as per Issue priorities → .

This thread has been idle, in the needs work state with no activity for several months. Therefore, I am assuming that you are no longer pursuing this application, and I marked it as Closed (won't fix).

If this is incorrect, and you are still pursuing this application, then please feel free to re-open it and set the issue status to Needs work or Needs review, depending on the current status of your code.