diff --git a/acl/edit_user.cgi b/acl/edit_user.cgi
index bc01e1afd..c50d3c511 100755
--- a/acl/edit_user.cgi
+++ b/acl/edit_user.cgi
@@ -2,10 +2,14 @@
 # edit_user.cgi
 # Edit a new or existing webmin user
 
+use strict;
+use warnings;
 require './acl-lib.pl';
+our (%in, %text, %config, %access, $config_directory, $base_remote_user);
 &foreign_require("webmin", "webmin-lib.pl");
 
 &ReadParse();
+my ($u, %user);
 if ($in{'user'}) {
 	# Editing an existing user
 	&can_edit_user($in{'user'}) || &error($text{'edit_euser'});
@@ -29,11 +33,11 @@ else {
 		}
 	$user{'skill'} = $user{'risk'} = 'high' if ($in{'risk'});
 	}
-$me = &get_user($base_remote_user);
+my $me = &get_user($base_remote_user);
 
 # Give up if readonly
 if ($user{'readonly'} && !$in{'readwrite'}) {
-	%minfo = &get_module_info($user{'readonly'});
+	my %minfo = &get_module_info($user{'readonly'});
 	print &text('edit_readonly', $minfo{'desc'},
 		    "edit_user.cgi?user=$in{'user'}&readwrite=1"),"<p>\n";
 	&ui_print_footer("", $text{'index_return'});
@@ -63,18 +67,18 @@ if ($in{'clone'}) {
 	}
 
 # Find and show parent group
-@glist = &list_groups();
-@mcan = $access{'gassign'} eq '*' ?
+my @glist = &list_groups();
+my @mcan = $access{'gassign'} eq '*' ?
 		( ( map { $_->{'name'} } @glist ), '_none' ) :
 		split(/\s+/, $access{'gassign'});
-map { $gcan{$_}++ } @mcan;
+my %gcan = map { $_, 1 } @mcan;
+my $memg;
 if (@glist && %gcan && !$in{'risk'} && !$user{'risk'}) {
-	@opts = ( );
+	my @opts = ( );
 	if ($gcan{'_none'}) {
 		push(@opts, [ undef, "&lt;$text{'edit_none'}&gt;" ]);
 		}
-	$memg = undef;
-	foreach $g (@glist) {
+	foreach my $g (@glist) {
 		if (&indexof($user{'name'}, @{$g->{'members'}}) >= 0 ||
 		    $in{'clone'} &&
 		     &indexof($in{'clone'}, @{$g->{'members'}}) >= 0) {
@@ -88,13 +92,14 @@ if (@glist && %gcan && !$in{'risk'} && !$user{'risk'}) {
 	}
 
 # Show password type menu and current password
-$passmode = !$in{'user'} ? 0 :
-	    $user{'pass'} eq 'x' ? 3 :
-	    $user{'sync'} ? 2 :
-	    $user{'pass'} eq 'e' ? 5 :
-	    $user{'pass'} eq '*LK*' ? 4 : 1;
+my $passmode = !$in{'user'} ? 0 :
+	       $user{'pass'} eq 'x' ? 3 :
+	       $user{'sync'} ? 2 :
+	       $user{'pass'} eq 'e' ? 5 :
+	       $user{'pass'} eq '*LK*' ? 4 : 1;
+my %miniserv;
 &get_miniserv_config(\%miniserv);
-@opts = ( [ 0, "$text{'edit_set'} .." ] );
+my @opts = ( [ 0, "$text{'edit_set'} .." ] );
 if ($in{'user'}) {
 	push(@opts, [ 1, $text{'edit_dont'} ]);
 	}
@@ -106,6 +111,7 @@ if ($miniserv{'extauth'}) {
 	push(@opts, [ 5, $text{'edit_extauth'} ]);
 	}
 push(@opts, [ 4, $text{'edit_lock'} ]);
+my ($lockbox, $tempbox);
 if ($passmode == 1) {
 	$lockbox = &ui_checkbox("lock", 1, $text{'edit_templock'},
 			               $user{'pass'} =~ /^\!/ ? 1 : 0);
@@ -114,8 +120,9 @@ if ($passmode != 3 && $passmode != 4) {
 	$tempbox = &ui_checkbox("temp", 1, $text{'edit_temppass'},
 				$user{'temppass'});
 	}
+my $expmsg;
 if ($user{'lastchange'} && $miniserv{'pass_maxdays'}) {
-	$daysold = int((time() - $user{'lastchange'})/(24*60*60));
+	my $daysold = int((time() - $user{'lastchange'})/(24*60*60));
 	if ($miniserv{'pass_lockdays'} &&
 	    $daysold > $miniserv{'pass_lockdays'}) {
 		$expmsg = "<br>"."<font color=#ff0000>".
@@ -132,7 +139,7 @@ if ($user{'lastchange'} && $miniserv{'pass_maxdays'}) {
 		$expmsg = "<br>".$text{'edit_passtoday'};
 		}
 	}
-$js = "onChange='form.pass.disabled = value != 0;'";
+my $js = "onChange='form.pass.disabled = value != 0;'";
 print &ui_table_row($text{'edit_pass'},
 	&ui_select("pass_def", $passmode, \@opts, 1, 0, 0, 0, $js)." ".
 	&ui_password("pass", undef, 25, $passmode != 0, undef,
@@ -152,8 +159,8 @@ if ($in{'user'}) {
 print &ui_hidden_table_end("rights");
 
 # Start of UI options section
-$showui = $access{'chcert'} || $access{'lang'} ||
-	  $access{'cats'} || $access{'theme'};
+my $showui = $access{'chcert'} || $access{'lang'} ||
+	     $access{'cats'} || $access{'theme'};
 if ($showui) {
 	print &ui_hidden_table_start($text{'edit_ui'}, "width=100%", 2, "ui",
 				     0, [ "width=30%" ]);
@@ -186,15 +193,15 @@ if ($access{'cats'}) {
 			    [ 0, $text{'default'} ] ]));
 	}
 
-if ($access{'theme'}) {
-	@all = &webmin::list_themes();
-	@themes = grep { !$_->{'overlay'} } @all;
-	@overlays = grep { $_->{'overlay'} } @all;
+my @all = &webmin::list_themes();
+my @themes = grep { !$_->{'overlay'} } @all;
+my @overlays = grep { $_->{'overlay'} } @all;
 
+if ($access{'theme'}) {
 	# Current theme
-	@topts = ( );
+	my @topts = ( );
 	push(@topts, [ "", $text{'edit_themedef'} ]);
-	foreach $t (@themes) {
+	foreach my $t (@themes) {
 		push(@topts, [ $t->{'dir'}, $t->{'desc'} ]);
 		}
 	print &ui_table_row($text{'edit_theme'},
@@ -218,8 +225,9 @@ if ($showui) {
 	}
 
 # Start of security options section
-$showsecurity = $access{'logouttime'} || $access{'ips'} || $access{'minsize'} ||
-		&supports_rbac() && $access{'mode'} == 0 || $access{'times'};
+my $showsecurity = $access{'logouttime'} || $access{'ips'} ||
+		   $access{'minsize'} ||
+		   &supports_rbac() && $access{'mode'} == 0 || $access{'times'};
 if ($showsecurity) {
 	print &ui_hidden_table_start($text{'edit_security'}, "width=100%", 2,
 				     "security", 0, [ "width=30%" ]);
@@ -242,8 +250,8 @@ if ($access{'minsize'}) {
 if ($access{'nochange'} && $miniserv{'pass_maxdays'}) {
 	# Opt out of forced password change, for this user
 	print &ui_table_row($text{'edit_nochange'},
-		&ui_radio("nochange", $user{'nochange'}, [ [ 0, $text{'yes'} ],
-							   [ 1, $text{'no'} ] ]));
+		&ui_radio("nochange", $user{'nochange'},
+			[ [ 0, $text{'yes'} ], [ 1, $text{'no'} ] ]));
 	}
 
 if ($access{'ips'}) {
@@ -270,8 +278,8 @@ if (&supports_rbac() && $access{'mode'} == 0) {
 
 if ($access{'times'}) {
 	# Show allowed days of the week
-	%days = map { $_, 1 } split(/,/, $user{'days'});
-	$daysels = "";
+	my %days = map { $_, 1 } split(/,/, $user{'days'});
+	my $daysels = "";
 	for(my $i=0; $i<7; $i++) {
 		$daysels .= &ui_checkbox("days", $i, $text{'day_'.$i},
 					 $days{$i});
@@ -283,8 +291,8 @@ if ($access{'times'}) {
 		$daysels);
 
 	# Show allow hour/minute range
-	($hf, $mf) = split(/\./, $user{'hoursfrom'});
-	($ht, $mt) = split(/\./, $user{'hoursto'});
+	my ($hf, $mf) = split(/\./, $user{'hoursfrom'});
+	my ($ht, $mt) = split(/\./, $user{'hoursto'});
 	print &ui_table_row($text{'edit_hours'},
 		&ui_radio("hours_def", $user{'hoursfrom'} eq '' ? 1 : 0,
 			[ [ 1, $text{'edit_allhours'} ],
@@ -297,7 +305,7 @@ if ($access{'times'}) {
 
 # Two-factor details
 if ($user{'twofactor_provider'}) {
-	($prov) = grep { $_->[0] eq $user{'twofactor_provider'} }
+	my ($prov) = grep { $_->[0] eq $user{'twofactor_provider'} }
 		       &webmin::list_twofactor_providers();
 	print &ui_table_row($text{'edit_twofactor'},
 		&text('edit_twofactorprov', "<i>$prov->[1]</i>",
@@ -316,30 +324,34 @@ print &ui_hidden_table_end("security");
 @mcan = $access{'mode'} == 1 ? @{$me->{'modules'}} :
 	$access{'mode'} == 2 ? split(/\s+/, $access{'mods'}) :
 			       &list_modules();
+my (%mcan, %has);
 map { $mcan{$_}++ } @mcan;
 map { $has{$_}++ } @{$user{'modules'}};
-map { $has{$_} = 0 } $group ? @{$group->{'modules'}} : ();
 
 # Start of modules section
+my @groups = &list_groups();
 print &ui_hidden_table_start(@groups ? $text{'edit_modsg'} : $text{'edit_mods'},
 			     "width=100%", 2, "mods");
 
 # Show available modules, under categories
-@mlist = grep { $access{'others'} || $has{$_->{'dir'}} || $mcan{$_->{'dir'}} }
-	      &list_module_infos();
-@links = ( &select_all_link("mod", 0, $text{'edit_selall'}),
+my @mlist = grep { $access{'others'} || $has{$_->{'dir'}} ||
+		   $mcan{$_->{'dir'}} } &list_module_infos();
+my @links = ( &select_all_link("mod", 0, $text{'edit_selall'}),
 	   &select_invert_link("mod", 0, $text{'edit_invert'}) );
-@cats = &unique(map { $_->{'category'} } @mlist);
+my @cats = &unique(map { $_->{'category'} } @mlist);
+my %catnames;
 &read_file("$config_directory/webmin.catnames", \%catnames);
-$grids = "";
-foreach $c (sort { $b cmp $a } @cats) {
-	@cmlist = grep { $_->{'category'} eq $c } @mlist;
-	$grids .= "<b>".($catnames{$c} || $text{'category_'.$c})."</b><br>\n";
-	@grid = ( );
-	$sw = 0;
-	foreach $m (@cmlist) {
-		local $md = $m->{'dir'};
-		$fromgroup = $memg && &indexof($md, @{$memg->{'modules'}}) >= 0;
+my $grids = "";
+foreach my $c (sort { $b cmp $a } @cats) {
+	my @cmlist = grep { $_->{'category'} eq $c } @mlist;
+	my $grids .= "<b>".($catnames{$c} ||
+			    $text{'category_'.$c})."</b><br>\n";
+	my @grid = ( );
+	my $sw = 0;
+	foreach my $m (@cmlist) {
+		my $md = $m->{'dir'};
+		my $fromgroup = $memg &&
+				&indexof($md, @{$memg->{'modules'}}) >= 0;
 		if ($mcan{$md} && $fromgroup) {
 			# Module comes from group
 			push(@grid, (sprintf "<img src=images/%s.gif> %s\n",
@@ -347,13 +359,13 @@ foreach $c (sort { $b cmp $a } @cats) {
 				($has{$md} ? &ui_hidden("mod", $md) : ""));
 			}
 		elsif ($mcan{$md}) {
-			$label = "";
+			my $label;
 			if ($access{'acl'} && $in{'user'}) {
 				# Show link for editing ACL
-                $label = ui_link("edit_acl.cgi?" .
-                     "mod=" . urlize($m->{'dir'}) .
-                     "&group=". urlize($in{'group'}),
-                     $m->{'desc'})  . "\n";
+				$label = ui_link("edit_acl.cgi?" .
+				     "mod=" . urlize($m->{'dir'}) .
+				     "&group=". urlize($in{'group'}),
+				     $m->{'desc'})  . "\n";
 				}
 			else {
 				# No privileges to edit ACL
@@ -375,10 +387,11 @@ print &ui_table_row(undef, &ui_links_row(\@links).
 print &ui_hidden_table_end("mods");
 
 # Add global ACL section, but only if not set from the group
-$groupglobal = $memg && -r "$config_directory/$memg->{'name'}.acl";
+my $groupglobal = $memg && -r "$config_directory/$memg->{'name'}.acl";
 if ($access{'acl'} && !$groupglobal && $in{'user'}) {
 	print &ui_hidden_table_start($text{'edit_global'}, "width=100%", 2,
 				     "global", 0, [ "width=30%" ]);
+	my %uaccess;
 	%uaccess = &get_module_acl($in{'user'}, "", 1);
 	print &ui_hidden("acl_security_form", 1);
 	&foreign_require("", "acl_security.pl");
@@ -387,10 +400,10 @@ if ($access{'acl'} && !$groupglobal && $in{'user'}) {
 	}
 
 # Generate form end buttons
-@buts = ( );
+my @buts = ( );
 push(@buts, [ undef, $in{'user'} ? $text{'save'} : $text{'create'} ]);
 if ($in{'user'}) {
-	if ($access{'create'} && !$group) {
+	if ($access{'create'}) {
 		push(@buts, [ "but_clone", $text{'edit_clone'} ]);
 		}
 	if (&foreign_available("webminlog")) {