Michael, I am happy to report that applying the latest patches to PHP 
from SUSE has resolved this bug.  This must have been a very recent 
patch because this system received the latest patches less than a few 
weeks ago.

THANK YOU for your help.

Thank you Michael.  I will investigate and report back if I find what 
is causing this.

So there's your problem.  If you have verified that the mailbox page 
is POSTing  more than once 'indices[]' parameter, and PHP is only 
parsing/recognizing a single parameter, the problem is either with the 
HTTP server or some internal PHP component.  Can't help anymore from 
the Horde side since it is not a bug here.

No, not running suhosin!  This is a fresh server image of SLES-11-SP2. 
  Here is the debug info.  Looks like we still have one message listed 
here also!

2012-12-07T14:19:03-05:00 DEBUG: Variable information:
array(9) {
   ["mailbox"]=>
   string(6) "dGVzdA"
   ["mailbox_token"]=>
   string(51) "UMJBC1k5RPulfsPRd-DYKiR-CE-zfGywf_9i5pwVGAZxD6H4Zyw"
   ["page"]=>
   string(1) "1"
   ["actionID"]=>
   string(15) "delete_messages"
   ["targetMbox"]=>
   string(0) ""
   ["newMbox"]=>
   string(1) "0"
   ["flag"]=>
   string(0) ""
   ["filter"]=>
   string(0) ""
   ["indices"]=>
   array(1) {
     [0]=>
     string(11) "{4}test9539"
   }
}

Backtrace:
1. Horde::debug() /data/www/horde/imp/mailbox.php:72

Looks like your PHP is broken.  Or, at a minimum, something is 
filtering duplicate POST parameters out.  (Please please please tell 
me you are not running suhosin).

To verify, replace the Horde:debug statements with this one:

Horde::debug($_REQUEST);

and report the results.

Thanks for the directions.  I placed two messages in one mailbox, 
selected them both and hit delete.  Here is the debug output for the 
delete:

2012-12-07T13:48:46-05:00 DEBUG: Variable information:
object(Horde_Variables)#129 (3) {
   ["_expected":protected]=>
   array(0) {
   }
   ["_sanitized":protected]=>
   bool(false)
   ["_vars":protected]=>
   array(9) {
     ["mailbox"]=>
     string(6) "dGVzdA"
     ["mailbox_token"]=>
     string(51) "UMI5-DNA5b2f3IJevV-4t3G8kOeiXKuKDi-qa2uLlpSrCt486Dc"
     ["page"]=>
     string(1) "1"
     ["actionID"]=>
     string(15) "delete_messages"
     ["targetMbox"]=>
     string(0) ""
     ["newMbox"]=>
     string(1) "0"
     ["flag"]=>
     string(0) ""
     ["filter"]=>
     string(0) ""
     ["indices"]=>
     array(1) {
       [0]=>
       string(11) "{4}test9539"
     }
   }
}

Backtrace:
1. Horde::debug() /data/www/horde/imp/mailbox.php:69

2012-12-07T13:48:46-05:00 DEBUG: Variable information:
object(IMP_Indices)#183 (2) {
   ["_default":protected]=>
   string(5) "INBOX"
   ["_indices":protected]=>
   array(1) {
     ["test"]=>
     array(1) {
       [0]=>
       int(9539)
     }
   }
}

Backtrace:
1. Horde::debug() /data/www/horde/imp/mailbox.php:70


And here is a dumpio trace from apache:

[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 32 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): POST /imp/mailbox.php HTTP/1.1\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 25 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Host: webml.bsc.gwu.edu\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 79 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): User-Agent: Mozilla/5.0 (Windows NT 6.1; 
rv:17.0) Gecko/20100101 Firefox/17.0\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 73 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Accept: 
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 33 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Accept-Language: en-US,en;q=0.5\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 32 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Accept-Encoding: gzip, deflate\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 24 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Connection: keep-alive\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 52 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Referer: 
https://webml.bsc.gwu.edu/imp/mailbox.php\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 136 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Cookie: default_horde_view=basic; 
Horde=sc24uc2r67e7aj3d3p0gb76soomn02d2lmelr19dqumbj6khubl1; 
horde_secret_key=i35VeC00LV9CCRcHwjep-w5\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 49 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Content-Type: 
application/x-www-form-urlencoded\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 21 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): Content-Length: 208\r\n
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [getline-blocking] 0 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 2 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): \r\n
[Fri Dec 07 13:54:44 2012] [info] Initial (No.1) HTTPS request 
received for child 0 (server webml.bsc.gwu.edu:443)
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(113): mod_dumpio: 
dumpio_in [readbytes-blocking] 208 readbytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(55): mod_dumpio:   
dumpio_in (data-TRANSIENT): 208 bytes
[Fri Dec 07 13:54:44 2012] [debug] mod_dumpio.c(74): mod_dumpio:   
dumpio_in (data-TRANSIENT): 
mailbox=dGVzdA&mailbox_token=UMI7XfJlxB_H76f6VDcxakIg20DPF5nwMXPzuAWoR5ImnCvVJX8&page=1&actionID=delete_messages&targetMbox=&newMbox=0&flag=&filter=&indices%5B%5D=%7B4%7Dtest9539&indices%5B%5D=%7B4%7Dtest9540

After line 66 in mailbox.php:

$indices = new IMP_Indices($vars->indices);

...put the following two debug statements:

Horde::debug($vars);
Horde::debug($indices);

And post the debug output (if it contains sensitive information, you 
can email directly to me).

Horde::debug() documentation: http://wiki.horde.org/Doc/Dev/DebugH4

I did some further tracing in addition to my previous POST data 
tracing that shows that when two messages are selected, both message 
IDs are passed on the POST data.

I did a IMAP trace and it looks like, as expected only the first of 
the two messages is deleted.  (see below).  Still not sure as to how 
to go about testing the parsing of the post data as per your 
suggestion. Any hint would be appreciated.
S: * OK [CAPABILITY IMAP4Rev1 QUOTA UNSELECT NAMESPACE  XIMAPPROXY] 
z/VM IMAP server Level 530 ready
C: [LOGIN Command - username: ariaimap]
S: * OK [XPROXYREUSE] IMAP connection reused by imapproxy
S: 1 OK User logged in
C: 2 SELECT "test"
S: * 2 EXISTS
S: * 0 RECENT
S: * OK [UNSEEN 1] Message 1 is first unseen
S: * OK [UIDVALIDITY 576194916]
S: * OK [UIDNEXT 9539] Predicted next UID
S: * FLAGS (\Unmarked)
S: * OK [PERMANENTFLAGS (\Seen \Answered \Flagged \Deleted \Draft)]
S: 2 OK [READ-WRITE] SELECT completed
C: 3 UID STORE 9537 +FLAGS \deleted
S: * 1 FETCH (FLAGS (\Deleted))
S: 3 OK UID STORE completed
C: 4 UID SEARCH ALL
S: * SEARCH 9537 9538
S: 4 OK UID SEARCH completed
C: 5 UID FETCH 9537:9538 (ENVELOPE FLAGS RFC822.SIZE 
BODY.PEEK[HEADER.FIELDS (IMPORTANCE LIST-POST X-PRIORITY)])
S: * 1 FETCH (ENVELOPE ("Fri, 7 Dec 2012 12:41:44 -0500" {9}
S: [LITERAL DATA: 9 bytes]
S:  (({11}
S: [LITERAL DATA: 11 bytes]
S:  NIL "aria" "bsc.gwu.edu")) (({11}
S: [LITERAL DATA: 11 bytes]
S:  NIL "aria" "bsc.gwu.edu")) (({11}
S: [LITERAL DATA: 11 bytes]
S:  NIL "aria" "bsc.gwu.edu")) (({13}
S: [LITERAL DATA: 13 bytes]
S:  NIL "aria" "bsc.gwu.edu")) NIL NIL NIL {41}
S: [LITERAL DATA: 41 bytes]
S: ) FLAGS (\Deleted) RFC822.SIZE 2593 BODY[HEADER.FIELDS (IMPORTANCE 
LIST-POST X-PRIORITY)] NIL UID 9537)
S: * 2 FETCH (ENVELOPE ("Fri, 7 Dec 2012 12:41:55 -0500" {9}
S: [LITERAL DATA: 9 bytes]
S:  (({11}
S: [LITERAL DATA: 11 bytes]
S:  NIL "aria" "bsc.gwu.edu")) (({11}
S: [LITERAL DATA: 11 bytes]
S:  NIL "aria" "bsc.gwu.edu")) (({11}
S: [LITERAL DATA: 11 bytes]
S:  NIL "aria" "bsc.gwu.edu")) (({13}
S: [LITERAL DATA: 13 bytes]
S:  NIL "aria" "bsc.gwu.edu")) NIL NIL NIL {41}
S: [LITERAL DATA: 41 bytes]
S: ) FLAGS () RFC822.SIZE 2595 BODY[HEADER.FIELDS (IMPORTANCE 
LIST-POST X-PRIORITY)] NIL UID 9538)
S: 5 OK UID FETCH completed
C: 6 SEARCH UNSEEN
S: * SEARCH 1 2
S: 6 OK SEARCH completed
C: 7 STATUS "INBOX" (MESSAGES RECENT UNSEEN)
S: * STATUS {5}
S: [LITERAL DATA: 5 bytes]
S:  (MESSAGES 233 RECENT 0 UNSEEN 0)
S: 7 OK STATUS completed
C: 8 LOGOUT
S: * BYE LOGOUT received
S: 8 OK Completed

I have traced the post data on the browser end and indeed, two 
indices[] show up on post :

POST /imp/mailbox.php HTTP/1.1
Host: webml.bsc.gwu.edu
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: default_horde_view=basic; 
horde_secret_key=9F2OVNdeQu3g0hyg4pivQg1; 
Horde=erfs9aivsnkfc4ep7s4vsc7i0h9ni4alprraggf32aartgq2alg1
Content-Type: application/x-www-form-urlencoded
Content-Length: 208
mailbox=dGVzdA&mailbox_token=UMCxwRtm87KT43AuGekR8xSEm8QcTGwhb8ZUsUtnjCYUG_F_x38&page=1&actionID=delete_messages&targetMbox=&newMbox=0&flag=&filter=&indices%5B%5D=%7B4%7Dtest9533&indices%5B%5D=%7B4%7Dtest9534
HTTP/1.1 200 OK


I also traced the apache end and see the post data coming in properly:

[debug] mod_dumpio.c(74): mod_dumpio:  dumpio_in (data-TRANSIENT): 
mailbox=dGVzdA&mailbox_token=UMCwMCVdR
25rZ-pdvsx6H4fVJI5oWSExo2aOuajrzzSf1s1-5bE&page=1&actionID=delete_messages&targetMbox=&newMbox=0&flag=&filter=&indices%5B%5D=%7B4%7D
test9533&indices%5B%5D=%7B4%7Dtest9534

However, due to my lack of PHP knowledge, I am unable to check whether 
it is being parsed correctly in the code per your instructions.  Can 
you give me more clue as to how to do that and get the output of the 
parsed data?

Thanks.

Look at the POST data to make sure you see multiple inidces[] 
parameters.  And then look in imp/mailbox.php to make sure these 
parameters are correctly parsed into multiple indices.  Line 66 of 
mailbox.php:

$indices = new IMP_Indices($vars->indices);

$indices should be an array with multiple values.

Thanks for your quick reply.  Can you provide some direction as to how 
I can debug this at my end and perhaps provide more information?  I 
have tried all obvious options, purged browser cache, tried different 
browsers, etc.

Thanks

Can't reproduce.  URL POST is correct (I have checked two messages to delete):

mailbox=[...]&indices%5B%5D=%7B7%7DMailbox2077&indices%5B%5D=%7B7%7DMailbox2075

As expected, there are two 'indices[]' entries.

Hi,

When using 'Basic' mode, if you place a check mark next to two or more 
messages and select an operation like Delete, only the first message 
in the list is acted on.  All others do not get deleted.  This happens 
on any other type of operation, such as undelete, move, etc.

The same action works in Dynamic mode.

Thanks,
Aria