Fix bulk action 400: Rack maps entries[] to params['entries'] not params['entries[]']HEADmain

Rack::Utils.parse_nested_query maps form fields named 'entries[]' to
params['entries'] (without brackets). The route was reading
params['entries[]'] which was always nil, making entries always empty
and triggering the halt 400 guard.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 3 insertions, 3 deletions

diff --git a/app.rb b/app.rb
index 9f02422..36d98ac 100644
--- a/app.rb
+++ b/app.rb
@@ -1011,7 +1011,7 @@ post '/admin/people/:uuid/bulk_move' do
   require_admin!
   src     = params[:uuid]
   action  = params['bulk_action'].to_s.strip
-  entries = Array(params['entries[]']).map { |e| JSON.parse(e) rescue nil }.compact
+  entries = Array(params['entries']).map { |e| JSON.parse(e) rescue nil }.compact
 
   halt 400 if entries.empty?
 
@@ -1117,7 +1117,7 @@ end
 
 post '/admin/people/:slug/bulk_reassign' do
   require_admin!
-  rels    = Array(params['rels[]'])
+  rels    = Array(params['rels'])
   to_uuid = params['to_uuid'].to_s.strip
   halt 400 if rels.empty? || to_uuid.empty?
 
@@ -1140,7 +1140,7 @@ end
 
 post '/admin/photos/move_album' do
   require_admin!
-  rels     = Array(params['rels[]'])
+  rels     = Array(params['rels'])
   dst_rel  = params['dst_rel'].to_s.strip.gsub(/\/+$/, '')
   halt 400 if rels.empty? || dst_rel =~ /\.\./