fix(manager): stop the false privilege error after changing a password (3.6)

core/src/Controllers/Password.php

@@ -1,6 +1,5 @@
 <?php namespace EvolutionCMS\Controllers;
 
-use EvolutionCMS\Models;
 use EvolutionCMS\Interfaces\ManagerTheme;
 
 class Password extends AbstractController implements ManagerTheme\PageControllerInterface
@@ -12,13 +11,7 @@ class Password extends AbstractController implements ManagerTheme\PageController
      */
     public function checkLocked(): ?string
     {
-        $out = Models\ActiveUser::locked(28)
-            ->first();
-        if ($out !== null) {
-            return sprintf($this->managerTheme->getLexicon('error_no_privileges'), $out->username);
-        }
-
-        return $out;
+        return null;
     }
 
     /**

core/src/Controllers/Users/ChangePassword.php

@@ -42,7 +42,8 @@ public function process() : bool
             }
         }
 
-        header("Location: index.php?a=99");
+        // not the user list (a=99): it needs edit_user, which this action does not require
+        header("Location: index.php?a=2");
         exit();
     }
 

core/src/Controllers/Users/DeleteUser.php

@@ -53,7 +53,9 @@ public function process() : bool
                 }
             }
         }
-        header("Location: index.php?a=99");
+        // the user list needs edit_user, which this action does not require
+        $landing = $this->managerTheme->getCore()->hasPermission('edit_user') ? 99 : 2;
+        header("Location: index.php?a={$landing}");
         exit();
     }
 

core/tests/Unit/Controllers/ChangePasswordRedirectTest.php

@@ -0,0 +1,21 @@
+<?php
+
+// #2553: the password is already saved by then, so a refused landing page reports a failure that did not happen
+test('a saved password lands on a page every role that may change it can open', function () {
+    $core = dirname(__DIR__, 3);
+    $controller = (string) file_get_contents($core . '/src/Controllers/Users/ChangePassword.php');
+    $theme = (string) file_get_contents($core . '/src/ManagerTheme.php');
+    $dashboard = (string) file_get_contents(dirname($core) . '/manager/views/page/2.blade.php');
+
+    expect($controller)
+        ->toContain('header("Location: index.php?a=2");')
+        ->not->toContain('Location: index.php?a=99')
+        ->and($theme)->toMatch('/^\s*2 => null,/m')
+        ->and($dashboard)->not->toContain('error_no_privileges');
+});
+
+test('the user list stays closed to roles without edit_user', function () {
+    $list = (string) file_get_contents(dirname(__DIR__, 4) . '/manager/actions/web_user_management.static.php');
+
+    expect($list)->toContain("hasPermission('edit_user')");
+});

core/tests/Unit/Controllers/DeleteUserRedirectTest.php

@@ -0,0 +1,11 @@
+<?php
+
+// the user is already deleted by then, so a refused landing page reports a failure that did not happen
+test('a deleted user lands on the user list only for a role that may open it', function () {
+    $source = (string) file_get_contents(dirname(__DIR__, 3) . '/src/Controllers/Users/DeleteUser.php');
+
+    expect($source)
+        ->toContain("\$landing = \$this->managerTheme->getCore()->hasPermission('edit_user') ? 99 : 2;")
+        ->toContain('header("Location: index.php?a={$landing}");')
+        ->not->toContain('header("Location: index.php?a=99");');
+});

core/tests/Unit/Controllers/PasswordPageLockTest.php

@@ -0,0 +1,10 @@
+<?php
+
+use EvolutionCMS\Controllers\Password;
+
+// the form changes the viewer's own password only, so another manager on it conflicts with nothing
+test('the change password page is never locked by another manager', function () {
+    $controller = (new ReflectionClass(Password::class))->newInstanceWithoutConstructor();
+
+    expect($controller->checkLocked())->toBeNull();
+});