In `@app/assets/javascripts/admin/controllers/admin-group.js.es6` around lines 11
- 14, The totalPages computed property (totalPages.property("limit",
"user_count")) incorrectly uses Math.floor(this.get("user_count") /
this.get("limit")) + 1 causing an extra page when user_count is an exact
multiple of limit; change the computation to use
Math.ceil(this.get("user_count") / this.get("limit")) and keep the zero-check
for user_count so totalPages returns 0 when user_count is 0.

In `@app/assets/javascripts/admin/templates/group.hbs` at line 29, The Add button
in the group.hbs template currently defaults to type="submit" and will submit
surrounding forms; update the <button> with the action "addMembers" to
explicitly include type="button" so clicking it won't trigger form submission,
leaving the class 'btn add', fa-icon "plus", and i18n 'admin.groups.add'
unchanged.

In `@app/assets/javascripts/admin/templates/group.hbs` around lines 46 - 51, The
two button elements that invoke the Ember actions "save" and "destroy" default
to type="submit" and will trigger native form submission; update both buttons
(the one with class 'btn btn-primary' invoking the "save" action and the
conditional 'btn btn-danger' invoking the "destroy" action) to include
type="button" so clicking them only runs the Ember actions and prevents page
reload/navigation.

In `@app/assets/javascripts/discourse/models/group.js` around lines 40 - 60, Both
removeMember and addMembers call self.findMembers() inside their .then()
callbacks but fail to return that promise, so callers resolve before the member
list finishes reloading; update the .then() handlers in removeMember and
addMembers to return self.findMembers() (i.e., change the callback to return the
promise from findMembers) so the promise chain waits for the member-list
refresh.

In `@app/assets/javascripts/discourse/routes/group-members.js.es6` around lines 8
- 12, setupController currently calls model.findMembers() but does not handle
its returned promise; attach error handling by either returning the promise from
setupController (so the router can handle rejections) or chaining a .catch(...)
on model.findMembers() to handle/log failures. Specifically, in setupController
(which sets group showing and controller.model), change the call to
model.findMembers() to either return model.findMembers() or to call
model.findMembers().catch(error => { /* handle or log e.g.,
controller.set('loadError', error) or this.onError(error) */ }) so rejections
are not left unhandled.

In `@app/controllers/admin/groups_controller.rb` around lines 6 - 9, The LIKE
wildcards in the user-provided search string are not escaped, so replace the raw
interpolation with an escaped version using ActiveRecord's sanitize_sql_like;
e.g. convert params[:search] to a string, call
ActiveRecord::Base.sanitize_sql_like(search) (or sanitize_sql_like(search) if
available) to escape %/_ then use groups.where("name ILIKE ?", "%#{escaped}%")
so the search treats literal % and _ correctly.

In `@app/controllers/groups_controller.rb` around lines 22 - 26, limit is
unbounded and offset can be negative; clamp both before querying: coerce
params[:limit] to an integer, cap it to a safe maximum (e.g., MAX_LIMIT constant
or 100) and ensure it is at least 1, and coerce params[:offset] to an integer
and clamp it to a minimum of 0; then use these sanitized values in the
group.users.order(:username_lower).limit(limit).offset(offset) query and keep
total = group.users.count unchanged.

In `@spec/controllers/admin/groups_controller_spec.rb` around lines 112 - 130, The
test for the remove_member action is using the wrong HTTP verb (xhr :put) so it
hits add_members; change the test that calls remove_member to use DELETE (xhr
:delete) so it exercises GroupsController#remove_member and matches the route
for "members" => "groups#remove_member"; update the spec example titled "cannot
remove members from automatic groups" to call xhr :delete, :remove_member with
the same params.