ⓘ This tightens local server-side batch file execution in the Users and Groups module.
Both user and group batch endpoints now read local batch files through a shared helper that enforces the module `batchdir` ACL, the user’s global file chooser ACL (`root` / `otherdirs`), and the configured `fileunix` read identity. Existing ACLs remain compatible by treating a missing `batchdir` as `/`, while an explicitly blank value denies local server batch files.
Regression coverage was added for allowed paths, denied paths, `otherdirs`, missing/blank `batchdir`, symlink escape rejection, and successful local batch reads.
----
Reproduction / verification steps:
1. Create a constrained Webmin user with access to the `Users and Groups` module.
2. Set the user's Global ACL:
- Root directory for file browser: `/home/user1`
- Other directories to allow: empty
- Browse as Unix user: `nobody`
3. Set the user's `Users and Groups` module ACL:
- Can view batch file form?: `Yes`
- Batch files must be under directory: `/`
4. Create test files on the Webmin host:
```sh
sudo mkdir -p /home/user1
echo ROOT_SECRET_MARKER | sudo tee /root/batch-secret.txt >/dev/null
sudo chown root:root /root/batch-secret.txt
sudo chmod 600 /root/batch-secret.txt
echo ALLOWED_BATCH_MARKER | sudo tee /home/user1/allowed.batch >/dev/null
sudo chmod 644 /home/user1/allowed.batch
sudo ln -sf /root/batch-secret.txt /home/user1/link-secret.batch
echo ROOT_ONLY_ALLOWED_MARKER | sudo tee /home/user1/root-only.batch >/dev/null
sudo chown root:root /home/user1/root-only.batch
sudo chmod 600 /home/user1/root-only.batch
```
5. Log in to Webmin as the constrained user and request:
```text
/useradmin/batch_exec.cgi?source=1&local=/root/batch-secret.txt
/useradmin/gbatch_exec.cgi?source=1&local=/root/batch-secret.txt
```
Expected fixed result:
```text
Local file location is not allowed
```
6. Request an allowed readable file:
```text
/useradmin/batch_exec.cgi?source=1&local=/home/user1/allowed.batch
/useradmin/gbatch_exec.cgi?source=1&local=/home/user1/allowed.batch
```
Expected fixed result:
```text
Invalid action at line 1 : ALLOWED_BATCH_MARKER
```
7. Request a symlink inside the allowed directory that points outside it:
```text
/useradmin/batch_exec.cgi?source=1&local=/home/user1/link-secret.batch
/useradmin/gbatch_exec.cgi?source=1&local=/home/user1/link-secret.batch
```
Expected fixed result:
```text
Local file location is not allowed
```
8. Request a root-only file inside the allowed directory:
```text
/useradmin/batch_exec.cgi?source=1&local=/home/user1/root-only.batch
/useradmin/gbatch_exec.cgi?source=1&local=/home/user1/root-only.batch
```
Expected fixed result:
```text
Local file not found
```
The fixed behavior confirms that local batch file imports now enforce the configured global file ACL, reject symlink escapes, and read files using the configured Unix identity instead of the privileged Webmin process.
