Bug: notify list delete action uses malformed UPDATE SET clause for host email reset

[somethingwithproof]

Summary

In notify_lists.php bulk delete flow, one SQL statement uses a malformed SET clause:

UPDATE host
SET thold_host_email = 0
AND deleted=""
WHERE ...

This uses AND deleted="" as part of the assignment expression instead of a WHERE filter.

Impact

• deleted="" filtering is not applied as intended.
• The expression semantics are incorrect and can silently produce unintended updates.

Location

• notify_lists.php in form_actions() delete path (drp_action == 1), around the host cleanup updates.

Expected

Use a standard update form:

SET thold_host_email = 0
WHERE deleted=""
AND ...

Proposed fix

Correct the query structure so filter conditions are in WHERE and assignment stays in SET.