Deleting trashed contacts with API call

[robinhood]

There has been some discussion about how to skip the recycle bin on a delete call, like this.  The wiki also says the same thing about deleting contacts permanently with an API call:

Note: if you want to skip the 'recycle bin' for entities that support undelete (e.g. contacts) you should set $param['skip_undelete'] => 1);

But, when I add skip_undelete to the call, I get this error:

CiviCRM_API3_Exception: Could not delete contact in civicrm_api3() (line 42 of /var/www/web/sites/all/modules/civicrm/api/api.php).

Without this parameter, the delete call works, and moves the contact to the trash.  What is the secret to doing a permanent delete from the API?

[Erik Hommel]

I have tried and the skip_undelete works for me! BUT it first told it could not because there would be financial blablabla....and after I deleted the contributions for the contact it went fine using

Code: [Select]

&id=999&skip_undelete=1

[robinhood]

Hmm.  These are spam accounts and there is nothing in them except an email and a name (a random-looking string of characters).  There shouldn't be any hangup with deleting financial data.   

[Erik Hommel]

As stated, it works for me  Have you tried it on the demo site?

[robinhood]

Ok - in case this wasn't clear, this is using PHP, not wget or anything so I can't really replicate the issue on the demo.  Code snippet is below.

Code: [Select]

function delete_spam( $template ) {
$res = civicrm_api3('Email', 'get', array(
'sequential' => 1,
'email' => array( 'LIKE' => $template ),
'is_primary' => 1,
));
// $params = array( 'skip_undelete' => 1 );
$params = array();
if (!$res['is_error']) {
foreach ( $res['values'] as $addr ) {
$params['id'] = $addr['contact_id'];
$res2 = civicrm_api3( 'Contact', 'delete', $params );
print "Deleting contact {$params['id']}\n";
}
}
}

[Erik Hommel]

I understand :-) You can try with the API explorer on demo?

[robinhood]

Ok I tried this on the API explorer on the demo, and successfully deleted contact #58 permanently.  I did the same thing on my test site, and it also works there through the API explorer.  So from what I can see, it only fails to work with PHP. 

Edit: I would be grateful if someone could try a permanent delete from PHP, so I know whether it is just in my install or a CiviBug.  Thanks.

[robinhood]

Perhaps some progress to report.

I found that the PHP call works if the "CiviCRM: delete contacts" permission is set for anonymous users.  That is clearly not a good solution (!) but tells me that this is a permissions problem.  How does one cure this?

The wiki says:

Here's how API usage is secured. It has two modes:

•     ignore permission (check_permissions=0): this is the default for smarty or php. This is to allow you to display information the user wouldn't see by default (eg. the list of staff to anonymous users)
•     use permission (check_permissions=1): this is the default for REST or Ajax and it can't be overriden. This is also the mode for smarty or php if you add check_permission=1

So the default mode for PHP is to not check permissions, but this call fails on a permissions check.  Something ain't right.

[Erik Hommel]

That does sound illogical 
Have you tried your API call with check_permission=0?

[robinhood]

Yes.  It still fails.

[Erik Hommel]

It does not make sense if it does work with the API explorer as it will use the same basic api function with the API Explorer as it does with PHP? Is there any other influencing factor?

[robinhood]

I posted an issue.

[Coleman Watts]

Well the difference seems to be that when you try with the API explorer, you are logged in. Whereas with php you are trying to do it while an anonymous user is triggering your script.
Probably the contact.delete api is just not properly passing through the check_permissions flag. Can you step through the code to check and hopefully submit a patch/PR to fix the issue?

[robinhood]

I tried that before posting the issue, and will try again when I get some time.  Civi internal workings are a bit overwhelming.