From fa61ef2df95f95f3b0a161050a30791ad86be697 Mon Sep 17 00:00:00 2001
From: Samuel Georges <sam@daftspunk.com>
Date: Sat, 27 Feb 2016 13:58:59 +1100
Subject: [PATCH] Fortify index_onDelete a little more Refs #1805

---
 modules/backend/behaviors/ListController.php | 59 +++++++++++++++++---
 modules/backend/lang/en/lang.php             |  1 +
 2 files changed, 52 insertions(+), 8 deletions(-)

diff --git a/modules/backend/behaviors/ListController.php b/modules/backend/behaviors/ListController.php
index a9fed1257..a1a8c7353 100644
--- a/modules/backend/behaviors/ListController.php
+++ b/modules/backend/behaviors/ListController.php
@@ -108,7 +108,7 @@ class ListController extends ControllerBehavior
          * Create the model
          */
         $class = $listConfig->modelClass;
-        $model = new $class();
+        $model = new $class;
         $model = $this->controller->listExtendModel($model, $definition);
 
         /*
@@ -245,25 +245,68 @@ class ListController extends ControllerBehavior
         $this->makeLists();
     }
 
+    /**
+     * Bulk delete records.
+     * @return void
+     */
     public function index_onDelete()
     {
         if (method_exists($this->controller, 'onDelete')) {
-            return $this->controller->onDelete();
+            return call_user_func_array([$this->controller, 'onDelete'], func_get_args());
         }
 
-        $model = $this->config->modelClass;
+        /*
+         * Validate checked identifiers
+         */
+        $checkedIds = post('checked');
 
-        if (($checkedIds = post('checked')) && is_array($checkedIds) && count($checkedIds)) {
-            foreach ($checkedIds as $id) {
-                if (!$record = $model::find($id)) {
-                    continue;
-                }
+        if (!$checkedIds || !is_array($checkedIds) || !count($checkedIds)) {
+            Flash::error(Lang::get('backend::lang.list.delete_selected_empty'));
+            return $this->controller->listRefresh();
+        }
 
+        /*
+         * Establish the list definition
+         */
+        $definition = post('definition', $this->primaryDefinition);
+
+        if (!isset($this->listDefinitions[$definition])) {
+            throw new ApplicationException(Lang::get('backend::lang.list.missing_parent_definition', compact('definition')));
+        }
+
+        $listConfig = $this->makeConfig($this->listDefinitions[$definition], $this->requiredConfig);
+
+        /*
+         * Create the model
+         */
+        $class = $listConfig->modelClass;
+        $model = new $class;
+        $model = $this->controller->listExtendModel($model, $definition);
+
+        /*
+         * Create the query
+         */
+        $query = $model->newQuery();
+        $this->controller->listExtendQueryBefore($query, $definition);
+
+        $query->whereIn($model->getKeyName(), $checkedIds);
+        $this->controller->listExtendQuery($query, $definition);
+
+        /*
+         * Delete records
+         */
+        $records = $query->get();
+
+        if ($records->count()) {
+            foreach ($records as $record) {
                 $record->delete();
             }
 
             Flash::success(Lang::get('backend::lang.list.delete_selected_success'));
         }
+        else {
+            Flash::error(Lang::get('backend::lang.list.delete_selected_empty'));
+        }
 
         return $this->controller->listRefresh();
     }
diff --git a/modules/backend/lang/en/lang.php b/modules/backend/lang/en/lang.php
index 2752375b8..80fea9b74 100644
--- a/modules/backend/lang/en/lang.php
+++ b/modules/backend/lang/en/lang.php
@@ -125,6 +125,7 @@ return [
         'missing_column' => 'There are no column definitions for :columns.',
         'missing_columns' => 'List used in :class has no list columns defined.',
         'missing_definition' => "List behavior does not contain a column for ':field'.",
+        'missing_parent_definition' => "List behavior does not contain a definition for ':definition'.",
         'behavior_not_ready' => 'List behavior has not been initialized, check that you have called makeLists() in your controller.',
         'invalid_column_datetime' => "Column value ':column' is not a DateTime object, are you missing a \$dates reference in the Model?",
         'pagination' => 'Displayed records: :from-:to of :total',