Merge pull request #2819 from webmin/dev/fix-useradmin-group-member-acl

Fix Users and Groups to honor user ACL in group member chooser

CHANGELOG.md

@@ -10,6 +10,7 @@
 * Fix to ignore failures when adding IPv6 link-local (fe80\:\:) addresses that may already be configured automatically
 * Fixed creation of permissions new log files in the System Logs module (thanks to Kevin Carter)
 * Fix Fail2Ban jail editor to correctly separate actions when one has no parameters [#2718](https://github.com/webmin/webmin/issues/2718)
+* Fix to honor the editable users ACL in the group member chooser in Users and Groups module [#2464](https://github.com/webmin/webmin/issues/2464)
 * Update the Authentic theme to the latest version with various improvements:
   - Fix change detection and submission for forms using grouped bottom action buttons
   - Fix login page front side clipping and flip animation for long welcome messages

useradmin/edit_group.cgi

@@ -83,13 +83,16 @@ print &ui_table_row(&hlink($text{'pass'}, "gpasswd"),
 # Member chooser
 @ulist = &sort_users(\@ulist, $config{'sort_mode'});
 if ($config{'membox'} == 0) {
-	# Nicer left/right chooser
+	# Nicer left/right chooser for users current Webmin user is allowed to
+	# edit
+	@canulist = grep { &can_edit_user(\%access, $_) } @ulist;
 	print &ui_table_row(&hlink($text{'gedit_members'}, "gmembers"),
 		&ui_multi_select("members",
 			[ map { [ $_, $_ ] }
 			      sort { lc($a) cmp lc($b) }
-				   split(/,/ , &html_escape($group{'members'})) ],
-			[ map { [ $_->{'user'}, &html_escape($_->{'user'}) ] } @ulist ],
+			      split(/,/ , &html_escape($group{'members'})) ],
+			[ map { [ $_->{'user'}, &html_escape($_->{'user'}) ] }
+				@canulist ],
 			10, 1, 0,
 			$text{'gedit_allu'}, $text{'gedit_selu'}, 150));
 	}

useradmin/lang/en

@@ -232,6 +232,8 @@ gsave_einuse=the group name '$1' is already in use
 gsave_egid='$1' is not a valid GID
 gsave_eggid=You are not allowed to change the GID of groups
 gsave_eallgid=All allowed GIDs have been allocated
+gsave_emember=You are not allowed to add the user $1 to this group
+gsave_ememberr=You are not allowed to remove the user $1 from this group
 gsave_eothers=The group was successfully saved, but an error occured in another module : $1
 usave_elowgid=GID must be greater than or equal to $1
 usave_ehigid=GID must be less than or equal to $1

useradmin/save_group.cgi

@@ -102,6 +102,20 @@ elsif ( $in{'gid_def'} eq '2' ) {
 	}
 
 @mems = split(/\r?\n/, $in{'members'});
+if ($access{'uedit_mode'} != 0) {
+	# Only users the Webmin user is allowed to edit can be added to or
+	# removed from the group
+	@ulist = &list_users();
+	%omems = map { $_, 1 } split(/,/, $ogroup{'members'});
+	%nmems = map { $_, 1 } @mems;
+	foreach $u (@ulist) {
+		$n = $u->{'user'};
+		next if (!$omems{$n} == !$nmems{$n});
+		next if (&can_edit_user(\%access, $u));
+		&error(&text($omems{$n} ? 'gsave_ememberr' : 'gsave_emember',
+			     &html_escape($n)));
+		}
+	}
 $group{'members'} = join(',', @mems);
 $group{'gid'} = $in{'gid'};