From ad2a1dc44ac787d8bf33cb236459e115d8095762 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Fri, 23 Oct 2026 20:28:25 +0200
Subject: [PATCH] Fix global ACL cleanup when deleting groups

This PR fixes deleted groups leaving their global ACL file behind.

It removes that file alongside the group's module ACL files. Recreating a group with the same name no longer restores its old global permissions.
---
 acl/acl-lib.pl | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/acl/acl-lib.pl b/acl/acl-lib.pl
index 070c9c837..0735f9e80 100755
--- a/acl/acl-lib.pl
+++ b/acl/acl-lib.pl
@@ -1183,7 +1183,9 @@ my $lref = &read_file_lines("$config_directory/webmin.groups");
 @$lref = grep { !/^([^:]+):/ || $1 ne $groupname } @$lref;
 &flush_file_lines();
 &unlock_file("$config_directory/webmin.groups");
-&unlink_file(map { "$config_directory/$_/$groupname.gacl" } &list_modules());
+# Remove global permissions too, so reusing the name cannot revive old ACLs.
+&unlink_file(map { "$config_directory/$_/$groupname.gacl" }
+		 ("", &list_modules()));
 
 if ($miniserv{'userdb'}) {
 	# Also delete from group database