Require password confirmation before setting/removing superuser access. (#13975)

* Require password confirmation for changing superuser access and fix issue where getSiteAccess is called w/ superuser when toggling superuser access.

* apply review feedback

* Allow bypassing password confirmation in certain scenarios.

* Fixing tests & adding UI test.

* Update submodule.

* test fixes + remove return; from 2fa tests.

* update submodule

* Fixing tests

* Couple tweaks for screenshot testing.

* test fixes

* Fix TwoFactorAuthUsersManager test.

* More test fixes.

* try to disable all transitions

* More UI test fixes + disable materialize animations globally in UI tests.

* 2fa ui tests now working

8 files changed, 45 insertions, 27 deletions

diff --git a/plugins/UsersManager/tests/UI/UsersManager_spec.js b/plugins/UsersManager/tests/UI/UsersManager_spec.js
index 6a7482ba5d..9ba0556c3e 100644
--- a/plugins/UsersManager/tests/UI/UsersManager_spec.js
+++ b/plugins/UsersManager/tests/UI/UsersManager_spec.js
@@ -74,9 +74,9 @@ describe("UsersManager", function () {
     });
 
     it('should select rows when individual row select is clicked', async function () {
-        await (await page.jQuery('td.select-cell label:eq(0)')).click();
-        await (await page.jQuery('td.select-cell label:eq(3)')).click();
-        await (await page.jQuery('td.select-cell label:eq(8)')).click();
+        await (await page.jQuery('td.select-cell label:eq(0)', { waitFor: true })).click();
+        await (await page.jQuery('td.select-cell label:eq(3)', { waitFor: true })).click();
+        await (await page.jQuery('td.select-cell label:eq(8)', { waitFor: true })).click();
         await page.mouse.move(0, 0);
         await page.waitFor(500); // for checkbox animations
 
@@ -116,7 +116,7 @@ describe("UsersManager", function () {
         await page.click('.toggle-select-all-in-search'); // reselect all in search
 
         await page.click('.bulk-actions.btn');
-        await (await page.jQuery('#user-list-bulk-actions>li:first')).hover();
+        await (await page.jQuery('#user-list-bulk-actions>li:first > a')).hover();
         await (await page.jQuery('#bulk-set-access a:contains(Admin)')).click();
         await page.waitFor(350); // wait for animation
 
@@ -231,7 +231,7 @@ describe("UsersManager", function () {
 
     it('should add access to all websites when bulk access is used on all websites in search', async function () {
         await page.click('.userPermissionsEdit .bulk-actions > .dropdown-trigger.btn');
-        await (await page.jQuery('#user-permissions-edit-bulk-actions>li:first')).hover();
+        await (await page.jQuery('#user-permissions-edit-bulk-actions>li:first>a')).hover();
         await (await page.jQuery('#user-permissions-edit-bulk-actions a:contains(Write)')).click();
 
         await page.waitFor('.change-access-confirm-modal', { visible: true });
@@ -277,7 +277,7 @@ describe("UsersManager", function () {
     it('should set access to selected sites when set bulk access is used', async function () {
         await page.click('.userPermissionsEdit .bulk-actions > .dropdown-trigger.btn');
         await page.waitFor(250); // animation
-        await (await page.jQuery('#user-permissions-edit-bulk-actions>li:first:visible', { waitFor: true })).hover();
+        await page.evaluate(() => $('#user-permissions-edit-bulk-actions>li:first > a:visible').mouseenter());
         await page.waitFor(250); // animation
         await (await page.jQuery('#user-permissions-edit-bulk-actions a:contains(Admin):visible', { waitFor: true })).click();
 
@@ -291,11 +291,12 @@ describe("UsersManager", function () {
     });
 
     it('should filter the permissions when the filters are used', async function () {
-        await page.type('div.site-filter>input', 'nova');
         await page.evaluate(function () {
-            $('.access-filter select').val('string:admin').change();
+            $('.userPermissionsEdit .access-filter select').val('string:admin').change();
         });
         await page.waitForNetworkIdle();
+        await page.type('.userPermissionsEdit div.site-filter>input', 'hunter');
+        await page.waitForNetworkIdle();
         await page.waitFor('#sitesForPermission tr', { visible: true });
         await page.waitFor(1000);
 
@@ -311,18 +312,20 @@ describe("UsersManager", function () {
 
     it('should set access to all sites selected when set bulk access is used', async function () {
         await page.click('.userPermissionsEdit .bulk-actions > .dropdown-trigger.btn');
-        await page.waitFor(100); // animation
-        await (await page.jQuery('#user-permissions-edit-bulk-actions>li:first', { waitFor: true })).hover();
-        await page.waitFor(100); // animation
+        await page.waitFor(250); // animation
+        await page.evaluate(() => $('#user-permissions-edit-bulk-actions>li:first > a:visible').mouseenter());
+        await page.waitFor(250); // animation
         await (await page.jQuery('#user-permissions-edit-bulk-actions a:contains(View)', { waitFor: true })).click();
         await page.waitFor(250); // animation
 
         await page.evaluate(() => $('.change-access-confirm-modal .modal-close:not(.modal-no):visible').click());
+        await page.waitForNetworkIdle();
 
         await page.evaluate(function () { // remove filter
             $('.access-filter select').val('string:some').change();
         });
         await page.waitForNetworkIdle();
+        await page.waitFor(250); // animation
 
         expect(await page.screenshotSelector('.usersManager')).to.matchImage('permissions_bulk_access_set_all');
     });
@@ -347,12 +350,12 @@ describe("UsersManager", function () {
 
         await page.waitFor(250); // animation
 
-        await page.evaluate(() => $('.confirmCapabilityToggle .modal-close:not(.modal-no):visible').click());
+        await page.evaluate(() => $('.userPermissionsEdit .confirmCapabilityToggle .modal-close:not(.modal-no):visible').click());
         await page.waitForNetworkIdle();
 
         await page.waitFor(250); // animation
 
-        expect(await page.screenshotSelector('.admin#content')).to.matchImage('permissions_capability_single_site');
+        expect(await page.screenshotSelector('.usersManager')).to.matchImage('permissions_capability_single_site');
     });
 
     it('should remove access to displayed rows when remove bulk access is clicked', async function () {
@@ -394,7 +397,22 @@ describe("UsersManager", function () {
         expect(await elem.screenshot()).to.matchImage('superuser_confirm');
     });
 
+    it('should fail to set superuser access if password is wrong', async function () {
+        await page.type('input#currentUserPasswordForSuperUser', 'wrongpassword');
+        await page.evaluate(() => $('.superuser-confirm-modal .modal-close:not(.modal-no):visible').click());
+        await page.waitForNetworkIdle();
+
+        await page.waitFor('.notification-error', { visible: true });
+
+        const notificationHtml = await page.evaluate(() => $('.notification-error>div').html());
+        expect(notificationHtml).to.equal('The current password you entered is not correct.');
+    });
+
     it('should give the user superuser access when the superuser modal is confirmed', async function () {
+        await page.click('.userEditForm #superuser_access+label');
+        await page.waitFor(500);
+
+        await page.type('input#currentUserPasswordForSuperUser', 'superUserPass');
         await page.evaluate(() => $('.superuser-confirm-modal .modal-close:not(.modal-no):visible').click());
         await page.waitForNetworkIdle();
         await page.waitFor(500);
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_manage_users_back.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_manage_users_back.png
index 9ffaaa81a1..228c7cc0cd 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_manage_users_back.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_manage_users_back.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f16ad832b1d64c645664e7e64408f25e491c31f3926e2da9773cc40916193009
-size 147836
+oid sha256:434264e176f6f4aa217c247fdcf032fca1d7304d8a33359e28505dc867231fcc
+size 147842
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_bulk_access_set_all.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_bulk_access_set_all.png
index 323e7bce5e..117d590b71 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_bulk_access_set_all.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_bulk_access_set_all.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:4af9d284d62698df449b104597006d73dc06855761fad90333def4febc11506c
-size 85673
+oid sha256:6806c1587d23ff706a62b908aeb141b98a052440f8220d14a21b688faae8b33c
+size 78284
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_capability_single_site.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_capability_single_site.png
index f2623bd5fb..c12b0af534 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_capability_single_site.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_capability_single_site.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:750fa07d8b3c6b5d7da0e68ede73131af3c1460c00aee070f2f1eda0e310d036
-size 96385
+oid sha256:c700040d1c3a9c7288d7a1f5d3354089709762dffb4764aa5f114f3bbca7c65f
+size 91417
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_filters.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_filters.png
index 1cda86e3aa..28b8a16607 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_filters.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_filters.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:0dbb9ad0fad0e51c572ce7b84cc59db7dea7083b702fc663fd3ab5cccffdb245
-size 28695
+oid sha256:595839d882d0c1d20f5ccd23dff2dbab68b24940e01683b9da44dfbea28e4cdb
+size 65467
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_select_all.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_select_all.png
index 9ffa892dc0..462864ba99 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_select_all.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_select_all.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:ad2b46f639d5a1d0d59299444b791011be309a71883f764cf1a22f7d712c5bbc
-size 29843
+oid sha256:4162bd79000733235fe891ccf4fa90f60af9862d6a39b02cc6ef6c35d96874a1
+size 67291
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_single_site_access.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_single_site_access.png
index 2d2a9d7736..93d4420205 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_single_site_access.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_permissions_single_site_access.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:5606bd6b54b2776f8a0df93ff31d5cd7a4f527e9b24fc0727a6e33286d234c01
-size 92464
+oid sha256:ae69632d1e3c8c2c8cae6d6d1bc3d0142ba4d5ff870e85d23637e149fad76311
+size 87826
diff --git a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_superuser_confirm.png b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_superuser_confirm.png
index 604d4b89c1..d30c26ebb8 100644
--- a/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_superuser_confirm.png
+++ b/plugins/UsersManager/tests/UI/expected-screenshots/UsersManager_superuser_confirm.png
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:556e3e32f67793bfb45a7fb1b618bc3f20a5c81fca3cc8049374c88674a5ee91
-size 15764
+oid sha256:8aca0c9d68a8f97ac9a9c82947fb3dc00ce51455a8f3abb34c5e055a1004471c
+size 19858