Fix to update nested group module access in parent order

acl/acl-lib.pl

@@ -1499,9 +1499,23 @@ foreach my $g (@groups) {
 			}
 		}
 	}
+my (@ordered_groups, %ordered_group, %ordering_group);
+my $add_ordered_group;
+$add_ordered_group = sub {
+	my ($g) = @_;
+	return if (!$g || $ordered_group{$g->{'name'}});
+	return if ($ordering_group{$g->{'name'}}++);
+	$add_ordered_group->($group_parent{$g->{'name'}});
+	delete($ordering_group{$g->{'name'}});
+	push(@ordered_groups, $g);
+	$ordered_group{$g->{'name'}}++;
+	};
+foreach my $g (@groups) {
+	$add_ordered_group->($g);
+	}
 
 # Update groups first, so member users and sub-groups inherit the new set
-foreach my $g (@groups) {
+foreach my $g (@ordered_groups) {
 	next if (!$all && !$target_group{$g->{'name'}});
 	my $gchanged = 0;
 	my $parent = $group_parent{$g->{'name'}};
@@ -2496,4 +2510,3 @@ return $mailbox."\@".join(".", @doms);
 }
 
 1;
-

acl/t/run-tests.t

@@ -769,6 +769,36 @@ is(group_line({ name => 'empty' }),
               'targeted group disable propagates to member user modules');
 }
 
+{
+    _reset_fixture();
+    create_user({ name => 'carol',
+                  pass => 'x',
+                  modules => [ 'useradmin' ] });
+    create_group({ name => 'child',
+                   members => [ 'carol' ],
+                   modules => [ 'useradmin' ],
+                   desc => 'Child group' });
+    create_group({ name => 'parent',
+                   members => [ '@child' ],
+                   modules => [ 'useradmin' ],
+                   desc => 'Parent group' });
+    _clear_caches();
+
+    is(enable_module_access([ 'apache' ]), 1,
+       'enable_module_access handles all nested groups');
+
+    my $child = get_group('child');
+    my $carol = get_user('carol');
+    is_deeply($child->{'modules'}, [ 'useradmin', 'apache' ],
+              'child group inherits module from parent enabled later in file');
+    is_deeply($child->{'ownmods'}, [],
+              'child group does not record inherited module as ownmod');
+    is_deeply($carol->{'modules'}, [ 'useradmin', 'apache' ],
+              'child group member inherits module through nested groups');
+    is_deeply($carol->{'ownmods'}, [],
+              'child group member does not record inherited module as ownmod');
+}
+
 {
     _reset_fixture();
     create_user({ name => 'root',