--- a/account.pm	Sun Dec 11 22:36:33 2011 +0100
+++ b/account.pm	Mon Dec 12 15:13:54 2011 +0100
@@ -322,7 +322,26 @@
         }
 
         if ( defined $Cf->aclgroups ) {
-            $e->replace( (AT_ACLGROUPS) => $Cf->aclgroups );
+
+            my $ag = $Cf->aclgroups;
+
+            if ($ag =~ /(^|,\s*)[+-]/) {
+                my %x;
+                @x{split /,/, $e->get_value(AT_ACLGROUPS)} = ();
+                for (split /,/, $ag) {
+                    if (s/^-//) {
+                        delete $x{$_};
+                    } else {
+                        s/^\+//;
+                        $x{$_} = undef;
+                    }
+                }
+
+                $ag = join ',', sort keys %x;
+
+            }
+
+            $e->replace( (AT_ACLGROUPS) => $ag );
             $modified++;
         }