[elcreator]

Fixes #2553.

Problem

A manager without edit_user who changes their own password gets "You don't have enough privileges for this action!" and loses the tab, although the password has changed.

ChangePassword::process() saves the password, then always redirects to a=99, the user list, and the list requires edit_user. Traced in Chrome on an Editor: 302 -> a=99, the alert, the tab closes.

The default Publisher has edit_user, so with the seeded roles only the Editor reproduces it; a Publisher role without that permission behaves the same.

Changes

One commit each:

• Change password: the save lands on the dashboard (a=2), where the form's Cancel button already goes and which no role is refused. This applies to every role, so administrators land there too instead of on the user list.
• Change password page lock: Password::checkLocked() refused anyone who opened the page while another manager had it open, with the same privilege message. The form only changes the viewer's own password, so there is nothing to conflict with, and the lock is gone.
• Delete user: DeleteUser had the same redirect. A role with delete_user but no edit_user deleted the user and then got the error. It now goes to the list only with edit_user, otherwise to the dashboard. Such a role has no link to this action, so this takes a direct URL with a valid token.

There is still no success message after saving a password, as before. It would need a new lexicon key and translations, so it is left out.

Verification

• tests/Unit tests/Feature on PHP 8.4 (Linux): 2253 passed, 9 skipped. PHPStan: no errors.
• New tests: ChangePasswordRedirectTest, PasswordPageLockTest, DeleteUserRedirectTest, each failing before its fix. The two redirect tests read the source, because process() ends in exit().
• In Chrome on a fresh 3.5.x install, before and after each fix: Editor, Publisher and Administrator saving a password (the new one logs in, the old one is refused), two real browsers on the form at once, and a delete with and without edit_user (the list still opens with it).

🤖 Generated with Claude Code