We recently had an incident where a large number of our production boxes were accidently deleted in part due to user error and another in what I think should be labeled as a bug.

Current behavior:
User does a search for specific hosts, selects a number of hosts to perform an action on. These host ids are added to the _ForemanSelectedhosts cookie. User executes action. User searches for another host and selects it for a action. _ForemanSelectedhosts still contains hosts from the previous selection even though they don't show up in the most recent search. You can verify this by highlighting over the top select checkbox or on the verification page when you go to perform the action.

Suggested behavior:
Though the hosts show up in the verification popup when you perform the action, you don't expect hosts that weren't recently selected to still be included in the action. I think it makes sense to clear the _ForemanSelectedhosts cookie once an action like "Build hosts" or "Change Group" has been performed.

This bug is proposed for backporting into 6.1 because Foreman Discovery uses the new "build_modal" function. This is an important bug to have, so rather than changing the way how discovery builds modal forms we should include this one.