01201: Excluding members from AuthUser groups doesn't work

Group password memberships are maintained by editing the SiteAdmin.AuthUser page. To specify a password group that allows access to anyone who is authenticated, you can specify:

    @wholeoffice: *

If you need to keep "Fred" out of this password group :

    @wholeoffice: *,-Fred

Index: authuser.php
===================================================================
--- authuser.php	(revision 2560)
+++ authuser.php	(working copy)
@@ -79,12 +79,12 @@
     $authlist[$g] = 1;
   foreach(preg_grep('/^@/', (array)@$auth['*']) as $g) 
     $authlist[$g] = 1;
-  foreach(preg_grep('/^@/', array_keys($auth)) as $g) 
-    if (in_array($authid, $auth[$g])) $authlist[$g] = 1;
   if ($auth['htgroup']) {
     foreach(AuthUserHtGroup($pagename, $id, $pw, $auth['htgroup']) as $g)
       $authlist["@$g"] = 1;
   }
+  foreach(preg_grep('/^@/', (array)@$auth["-$authid"]) as $g) 
+    unset($authlist[$g]);
   SessionAuth($pagename, array('authid' => $authid, 'authlist' => $authlist));
 }