github-featured/webmin--webmin
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity

Fix Users and Groups to honor user ACL in group member chooser

Browse Source 
This PR fixes the Users and Groups module to honor the "Unix users who can be edited" ACL when editing group members.

Before, the group edit form listed all system users in the members chooser and accepted any user on save, regardless of the ACL.

Now only editable users are offered, and adding or removing a non-editable user is rejected.

Fixes #2464
This commit is contained in:
Ilia Ross
2026-08-19 20:30:34 +02:00
parent ac9f655e22
commit 40a8d3a694
4 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -10,6 +10,7 @@
* Fix to ignore failures when adding IPv6 link-local (fe80\:\:) addresses that may already be configured automatically
* Fixed creation of permissions new log files in the System Logs module (thanks to Kevin Carter)
* Fix Fail2Ban jail editor to correctly separate actions when one has no parameters [#2718](https://github.com/webmin/webmin/issues/2718)
* Fix to honor the editable users ACL in the group member chooser in Users and Groups module [#2464](https://github.com/webmin/webmin/issues/2464)
* Update the Authentic theme to the latest version with various improvements:
- Fix change detection and submission for forms using grouped bottom action buttons
- Fix login page front side clipping and flip animation for long welcome messages
useradmin/edit_group.cgi
+6 -3
View File
@@ -83,13 +83,16 @@ print &ui_table_row(&hlink($text{'pass'}, "gpasswd"),
# Member chooser
@ulist = &sort_users(\@ulist, $config{'sort_mode'});
if ($config{'membox'} == 0) {
# Nicer left/right chooser
# Nicer left/right chooser for users current Webmin user is allowed to
# edit
@canulist = grep { &can_edit_user(\%access, $_) } @ulist;
print &ui_table_row(&hlink($text{'gedit_members'}, "gmembers"),
&ui_multi_select("members",
[ map { [ $_, $_ ] }
sort { lc($a) cmp lc($b) }
split(/,/ , &html_escape($group{'members'})) ],
[ map { [ $_->{'user'}, &html_escape($_->{'user'}) ] } @ulist ],
split(/,/ , &html_escape($group{'members'})) ],
[ map { [ $_->{'user'}, &html_escape($_->{'user'}) ] }
@canulist ],
10, 1, 0,
$text{'gedit_allu'}, $text{'gedit_selu'}, 150));
}
useradmin/lang/en
+2
View File
@@ -232,6 +232,8 @@ gsave_einuse=the group name '$1' is already in use
gsave_egid='$1' is not a valid GID
gsave_eggid=You are not allowed to change the GID of groups
gsave_eallgid=All allowed GIDs have been allocated
gsave_emember=You are not allowed to add the user $1 to this group
gsave_ememberr=You are not allowed to remove the user $1 from this group
gsave_eothers=The group was successfully saved, but an error occured in another module : $1
usave_elowgid=GID must be greater than or equal to $1
usave_ehigid=GID must be less than or equal to $1
useradmin/save_group.cgi
+14
View File
@@ -102,6 +102,20 @@ elsif ( $in{'gid_def'} eq '2' ) {
}
@mems = split(/\r?\n/, $in{'members'});
if ($access{'uedit_mode'} != 0) {
# Only users the Webmin user is allowed to edit can be added to or
# removed from the group
@ulist = &list_users();
%omems = map { $_, 1 } split(/,/, $ogroup{'members'});
%nmems = map { $_, 1 } @mems;
foreach $u (@ulist) {
$n = $u->{'user'};
next if (!$omems{$n} == !$nmems{$n});
next if (&can_edit_user(\%access, $u));
&error(&text($omems{$n} ? 'gsave_ememberr' : 'gsave_emember',
&html_escape($n)));
}
}
$group{'members'} = join(',', @mems);
$group{'gid'} = $in{'gid'};