From 1445cd76411ceca9197017aa9bb7e35518485ea8 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 14 Jun 2026 13:29:54 -0700
Subject: [PATCH] Check permission to delete home dirs in batch operations

---
 useradmin/batch_exec.cgi       | 3 ++-
 useradmin/mass_delete_user.cgi | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/useradmin/batch_exec.cgi b/useradmin/batch_exec.cgi
index c04da138e..b7085bd3e 100755
--- a/useradmin/batch_exec.cgi
+++ b/useradmin/batch_exec.cgi
@@ -392,7 +392,8 @@ foreach $line (split(/[\r\n]+/, $data)) {
 		# Delete his home directory
 		if ($in{'delhome'} &&
 		    $user->{'home'} &&
-		    $user->{'home'} !~ /^\/+$/) {
+		    $user->{'home'} !~ /^\/+$/ &&
+		    $access{'delhome'}) {
 			&delete_home_directory($user);
 			}
 
diff --git a/useradmin/mass_delete_user.cgi b/useradmin/mass_delete_user.cgi
index a88901ebb..747c395f6 100755
--- a/useradmin/mass_delete_user.cgi
+++ b/useradmin/mass_delete_user.cgi
@@ -222,7 +222,8 @@ else {
 				}
 			&unlock_user_files();
 
-			if ($in{'delhome'} && $user->{'home'} !~ /^\/+$/) {
+			if ($in{'delhome'} && $user->{'home'} !~ /^\/+$/ &&
+			    $access{'delhome'}) {
 				print "$text{'udel_home'}<br>\n";
 				&lock_file($user->{'home'});
 				&delete_home_directory($user);