CSRF check failed for permanent delete of domains above 250 records

[MarcSamD]

• [X] I agree to follow this project's Code of Conduct
• [X] I have searched the existing issues

Version

10.0.7 with MainAsset.php modified

Bug description

Following the issue #14489 I have 5k domain records to delete.

First, to delete them, it can only be done 1000 per 1000. If trying to select more, there is no error message but it will not work. I remember in previous GLPI version there was a limitation to forbid mass action above 1k records, maybe this should be added again ?

But the main issue is not here but for the permanent delete. I can delete 250 records but if I try to delete 500 or more at once, I have the error message "The action you have requested is not allowed." In access-errors.log I can see the message "CSRF check failed for User ID: XX at /front/massiveaction.php"

Knowing it works for the normal delete and for permanenent delete of 250 records, is it really a CSRF issue ?

[cedric-anne]

The problem is due to exceeding the maximum value of max_input_vars.

[ak47d]

Hi, I'm facing a similar problem. But I managed to create more than 1.2 million duplicate domain records. This became a big problem. Please tell me. How can you remove duplicate domains as quickly and easily as possible? Is it possible to do this faster with a direct SQL query? If so, which one? And what then to do with elements associated with a domain? Will it be correct to delete a domain without deleting links with it? I hope very much for your help.

[ftoledo]

I setup max_input_vars to 5000 and i can select the 5000 items softwares and sent to trash without problem.

In trash view (Deleted items list) If select the 5000 items (to permanent delete) I get access denied (CSRF check failed for User ID: 70 at /front/massiveaction.php)... I can only select up to 2000 items here.

I suppose that in the trash view, the form must sending 2 variables for each item. So no more that 2500 items can be deleted from trash..