[HIGH] H6: updateUserGroups precedence bug — group removal never runs, users accumulate groups forever

[rubenvdlinde]

Severity: HIGH

Location: lib/Controller/ContactpersonenController.php lines 598–710, specifically line 628

Description:
updateUserGroups contains a precedence bug in the in_array call:

in_array(needle: $group->getGID() === true, haystack: $allowedGroups)

The === operator has higher precedence than the function arguments, so needle evaluates to the boolean result of $group->getGID() === true, which is always false. $curCatalogGroups is therefore always an empty array, and the removal-from-groups branch never executes. Users continuously accumulate group memberships with no way for the system to revoke them.

Suggested fix:

in_array(needle: $group->getGID(), haystack: $allowedGroups) === true

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in #355 (merged to development).