Everything in editgroups.cgi right now is based on the 'creategroups' priv. Users should also be allowed in if they have caneditgroupmembers, but just not allowed to Add, Edit, or Delete groups (just edit members). Also, if the user has blessgroupset privs for any groups, they should be allowed in, and only able to see the groups they have access to.

Should editgroupmembers get them into editgroups.cgi? I would think that that would get them into editusers.cgi, with an interface similar to when you've got the bless group bit turned on for one or more groups... In fact, it sounds, from the description, like someone in the editgroupmembers group should be considered to have the bless group bit turned on for each group they're in. Am I reading this wrong?

I think you've got it. That's what I was thinking. There's a number of privs defined right now that don't really mean anything. That being one of them. That's what I files this bug for, to remind us when we got back to working on those that it still didn't cover everything it was supposed to.

No clue what I was thinking here, unless we wanted to add that group. This could probably be handled by checking blessgroupset or editusers... certainly not a 2.14 blocker.

We are currently trying to wrap up Bugzilla 2.16. We are now close enough to release time that anything that wasn't already ranked at P1 isn't going to make the cut. Thus this is being retargetted at 2.18. If you strongly disagree with this retargetting, please comment, however, be aware that we only have about 2 weeks left to review and test anything at this point, and we intend to devote this time to the remaining bugs that were designated as release blockers.

This is already covered. Anyone who can bless any group can use editusers to do so.