Sloppy commit on my part. Sorry. My commit didn't fix the bug. So I'm undoing it.

interface/web/mail/mail_user_filter_edit.php

@@ -54,7 +54,7 @@ class page_action extends tform_actions {
 		global $app, $conf;
 		
 		// Get the parent mail_user record
-		$mailuser = $app->db->queryOneRecord("SELECT * FROM mail_user WHERE mailuser_id = '".intval($_REQUEST["mailuser_id"])."'");
+		$mailuser = $app->db->queryOneRecord("SELECT * FROM mail_user WHERE mailuser_id = '".intval($_REQUEST["mailuser_id"])."' AND ".$app->tform->getAuthSQL('r'));
 		
 		// Check if Domain belongs to user
 		if($mailuser["mailuser_id"] != $_POST["mailuser_id"]) $app->tform->errorMessage .= $app->tform->wordbook["no_mailuser_perm"];