{"record":{"id":"e132ad0633e643c0","repo":"OrchardCMS/OrchardCore","slug":"invalid-bulk-options","errorCode":null,"errorMessage":"Invalid bulk options.","messagePattern":"Invalid bulk options\\.","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.Users/Controllers/AdminController.cs","lineNumber":273,"sourceCode":"                            await _notifier.SuccessAsync(H[\"User {0} successfully deleted.\", user.UserName]);\n                        }\n                        break;\n                    case UsersBulkAction.Disable:\n                        if (!isSameUser && canEditUser)\n                        {\n                            await _userService.DisableAsync(user);\n                            await _notifier.SuccessAsync(H[\"User {0} successfully disabled.\", user.UserName]);\n                        }\n                        break;\n                    case UsersBulkAction.Enable:\n                        if (!isSameUser && canEditUser)\n                        {\n                            await _userService.EnableAsync(user);\n                            await _notifier.SuccessAsync(H[\"User {0} successfully enabled.\", user.UserName]);\n                        }\n                        break;\n                    default:\n                        throw new ArgumentOutOfRangeException(options.BulkAction.ToString(), \"Invalid bulk options.\");\n                }\n            }\n        }\n\n        return RedirectToAction(nameof(Index));\n    }\n\n    public async Task<IActionResult> Create()\n    {\n        var user = new User();\n\n        if (!await _authorizationService.AuthorizeAsync(User, UsersPermissions.EditUsers, user))\n        {\n            return Forbid();\n        }\n\n        var shape = await _userDisplayManager.BuildEditorAsync(user, updater: _updateModelAccessor.ModelUpdater, isNew: true, string.Empty, string.Empty);\n","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.Users/Controllers/AdminController.cs#L255-L291","documentation":"The Users AdminController Index POST action iterates selected users and applies the chosen BulkAction (e.g. Enable/Disable/Delete). If the submitted bulk action value falls outside the known enum cases, the default branch throws ArgumentOutOfRangeException with the message 'Invalid bulk options.', defending against tampered or outdated form posts.","triggerScenarios":"Posting the user Index form with a bulkAction value that is not one of the supported enum values — e.g. hand-crafted/tampered POST, stale client page after a server enum change, or an automated client sending an out-of-range value.","commonSituations":"Browser extension or script altering the form; server upgraded with new/renamed bulk actions while an old cached admin page posts old values; API/script integration posting invalid bulkAction numbers.","solutions":["Reload the Users admin page and retry with a valid bulk action (Enable/Disable/Delete) so the posted value matches the current enum.","Inspect the POST payload (bulkAction field) and correct it to a supported value.","If integrating programmatically, update the client to send valid enum values from the current OrchardCore.Users version.","Clear cached admin pages/scripts after upgrading Orchard Core."],"exampleFix":"// before (form post)\nbulkAction=9\n// after\nbulkAction=1 // e.g. BulkAction.Enable","handlingStrategy":"validation","validationCode":"// client-side: only submit whitelisted bulk actions\nif (!['enable','disable','delete'].includes(bulkAction)) {\n  alert('Choose a valid bulk action');\n  return;\n}","typeGuard":"const isBulkAction = (v) => ['Enable','Disable','Delete'].includes(v);","tryCatchPattern":"try {\n  await ApplyBulkActionAsync(bulkAction, userIds);\n} catch (ArgumentOutOfRangeException ex) when (ex.Message.Contains(\"Invalid bulk options\")) {\n  _notifier.Warning(H[\"Unsupported bulk action selected. Refresh the page and try again.\"]);\n}","preventionTips":["Re-render the Users index after upgrades so form posts carry current enum values.","Never craft bulkAction values manually in scripts/integrations.","Wrap admin bulk operations in try/catch with user-friendly notifier messages.","Server-side: map/validate the posted value against the enum before the switch."],"tags":["users","admin","argumentoutofrange","form-post"],"backgroundTag":"argument-out-of-range","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}