[labkey-adam]

Rationale

Group membership changes are now always made from the container that owns the group, with the same checks applied everywhere members are added or removed, including folder import. GH Issue 1695

Related Pull Requests

• Replaces GH Issue 1695: Require group-owning container for all group membershi… #8264, which targeted develop

Changes

• Site group membership can be changed only from the root, and project group membership only from its own project
• Folder import always updates project groups, regardless of the group type in the archive
• Site Users and Guests group membership can't be changed by anyone
• Added integration tests for each case

[labkey-matthewb]

Claude points out that the AddUser with clone option should require SiteAdmin (related but differnt action).

[labkey-adam]

Claude points out that the AddUser with clone option should require SiteAdmin (related but differnt action).

There's a separate OWASP issue for that: https://github.com/LabKey/internal-issues/issues/1696

I'll address it shortly in 26.11, but I want to make service team and product managers aware first.