users.php: 249-296
During some tesing, found that there is a User Group request in users.php lines 252 and 276. The variable $group is not used afterwards. Futher more there is no field or link to parameter "grpaction" (unless entered manually in URL, which is a bad idea). So the whole block is not used and probably can be deleted.
usergrps.php 37, 39
Same "grpaction" parameter is checked in usergrps.php lines 37 and 39, but not used anywhere else. Probably safe to remove it there.
Incident report
Trivial