From 40a8d3a6941e71b18a38ac50fc185156ecf78f7f Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Wed, 19 Aug 2026 20:30:34 +0200
Subject: [PATCH] Fix Users and Groups to honor user ACL in group member
 chooser

This PR fixes the Users and Groups module to honor the "Unix users who can be edited" ACL when editing group members.

Before, the group edit form listed all system users in the members chooser and accepted any user on save, regardless of the ACL.

Now only editable users are offered, and adding or removing a non-editable user is rejected.

Fixes #2464
---
 CHANGELOG.md             |  1 +
 useradmin/edit_group.cgi |  9 ++++++---
 useradmin/lang/en        |  2 ++
 useradmin/save_group.cgi | 14 ++++++++++++++
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77fda4d24..07d88ef3e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@
 * Fix to ignore failures when adding IPv6 link-local (fe80\:\:) addresses that may already be configured automatically
 * Fixed creation of permissions new log files in the System Logs module (thanks to Kevin Carter)
 * Fix Fail2Ban jail editor to correctly separate actions when one has no parameters [#2718](https://github.com/webmin/webmin/issues/2718)
+* Fix to honor the editable users ACL in the group member chooser in Users and Groups module [#2464](https://github.com/webmin/webmin/issues/2464)
 * Update the Authentic theme to the latest version with various improvements:
   - Fix change detection and submission for forms using grouped bottom action buttons
   - Fix login page front side clipping and flip animation for long welcome messages
diff --git a/useradmin/edit_group.cgi b/useradmin/edit_group.cgi
index 2fda052c5..497315aee 100755
--- a/useradmin/edit_group.cgi
+++ b/useradmin/edit_group.cgi
@@ -83,13 +83,16 @@ print &ui_table_row(&hlink($text{'pass'}, "gpasswd"),
 # Member chooser
 @ulist = &sort_users(\@ulist, $config{'sort_mode'});
 if ($config{'membox'} == 0) {
-	# Nicer left/right chooser
+	# Nicer left/right chooser for users current Webmin user is allowed to
+	# edit
+	@canulist = grep { &can_edit_user(\%access, $_) } @ulist;
 	print &ui_table_row(&hlink($text{'gedit_members'}, "gmembers"),
 		&ui_multi_select("members",
 			[ map { [ $_, $_ ] }
 			      sort { lc($a) cmp lc($b) }
-				   split(/,/ , &html_escape($group{'members'})) ],
-			[ map { [ $_->{'user'}, &html_escape($_->{'user'}) ] } @ulist ],
+			      split(/,/ , &html_escape($group{'members'})) ],
+			[ map { [ $_->{'user'}, &html_escape($_->{'user'}) ] }
+				@canulist ],
 			10, 1, 0,
 			$text{'gedit_allu'}, $text{'gedit_selu'}, 150));
 	}
diff --git a/useradmin/lang/en b/useradmin/lang/en
index c5258ec9f..d2c692224 100644
--- a/useradmin/lang/en
+++ b/useradmin/lang/en
@@ -232,6 +232,8 @@ gsave_einuse=the group name '$1' is already in use
 gsave_egid='$1' is not a valid GID
 gsave_eggid=You are not allowed to change the GID of groups
 gsave_eallgid=All allowed GIDs have been allocated
+gsave_emember=You are not allowed to add the user $1 to this group
+gsave_ememberr=You are not allowed to remove the user $1 from this group
 gsave_eothers=The group was successfully saved, but an error occured in another module : $1
 usave_elowgid=GID must be greater than or equal to $1
 usave_ehigid=GID must be less than or equal to $1
diff --git a/useradmin/save_group.cgi b/useradmin/save_group.cgi
index b64d91114..7aad3cc12 100755
--- a/useradmin/save_group.cgi
+++ b/useradmin/save_group.cgi
@@ -102,6 +102,20 @@ elsif ( $in{'gid_def'} eq '2' ) {
 	}
 
 @mems = split(/\r?\n/, $in{'members'});
+if ($access{'uedit_mode'} != 0) {
+	# Only users the Webmin user is allowed to edit can be added to or
+	# removed from the group
+	@ulist = &list_users();
+	%omems = map { $_, 1 } split(/,/, $ogroup{'members'});
+	%nmems = map { $_, 1 } @mems;
+	foreach $u (@ulist) {
+		$n = $u->{'user'};
+		next if (!$omems{$n} == !$nmems{$n});
+		next if (&can_edit_user(\%access, $u));
+		&error(&text($omems{$n} ? 'gsave_ememberr' : 'gsave_emember',
+			     &html_escape($n)));
+		}
+	}
 $group{'members'} = join(',', @mems);
 $group{'gid'} = $in{'gid'};