[elcreator]

Port of #2556 to 3.6.x, for #2553. The code had the same three defects, and the commits apply unchanged.

Changes

One commit each:

• Change password: the save redirected to the user list (a=99), which needs edit_user, so a role without it got "You don't have enough privileges for this action!" and lost the tab, although the password had changed. It now lands on the dashboard (a=2), for every role.
• Change password page lock: Password::checkLocked() refused anyone who opened the page while another manager had it open, with the same message. The form only changes the viewer's own password, so the lock is gone.
• Delete user: a role with delete_user but no edit_user deleted the user and then got the error from the list. It now goes to the list only with edit_user, otherwise to the dashboard.

Verification

• tests/Unit tests/Feature on PHP 8.4 (Linux): 2439 passed, 9 skipped. PHPStan: no errors.
• In Chrome on a fresh 3.6 install with the fixes: Editor, Publisher and Administrator saving a password (the new one logs in, the old one is refused), two real browsers on the form at once, and a delete with and without edit_user (the list still opens with it). The failures themselves were reproduced on 3.5.x, see fix(manager): stop the false privilege error after changing a password #2556.

🤖 Generated with Claude Code