Require password confirmation for more plugin operations.

[diosmosis]

Description:

Adding requirement for password confirmation for: activating a plugin, deactivating a plugin, uninstalling a plugin. And for CorePluginsAdmin.setSystemSettings.

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done see checklist
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[flamisz]

Is it common for asking password as a URL parameter when we already have the token validation? Is it necessary? I can't remember using API like this.

[diosmosis]

@flamisz if you grep through API files for 'passwordConfirmation', you'll find similar methods. It is an extra security precaution for sensitive settings and changes.

Also just realized I forgot to the UI related changes, will move this back to a draft.

[diosmosis]

Added the UI changes. Also noticed we were using the old ready: event for materializecss modals, should be using onOpenEnd now.

[diosmosis]

@sgiehl this should be ready for another review

[sgiehl]

Seems to work as expected now. Some UI tests for TagManager and QueuedTracking are failing due to the new password confirmation. Might be good to fix them before merging