Merge branch 'stable-2.9' into stable-2.10

* stable-2.9:
  Update 2.9.1 release notes again
  Update 2.9.1 release notes
  Fix: permission on user specific reference name cannot work

Change-Id: If55ca570970fb22ba0590dbf598b4fe342ffeb56

ReleaseNotes/ReleaseNotes-2.9.1.txt

@@ -97,3 +97,9 @@ Display parents for all changes, not only merge commits.
 In the new change screen the parent commit is now also shown for regular
 commits, as well as merge commits. This makes it consistent with the old
 change screen.
+
+* Fix handling of permissions for user-specific refs.
++
+Push permission granted on a ref using the `${username}` placeholder, for
+example `refs/heads/users/${username}/*`, was not honored if this was the
+only ref on which the user had push permission.

gerrit-server/src/main/java/com/google/gerrit/server/project/RefPatternMatcher.java

@@ -110,13 +110,24 @@ public abstract class RefPatternMatcher {
         u = username;
       }
 
-      RefPatternMatcher next =
-          getMatcher(template.replace(Collections.singletonMap("username", u)));
-      return next != null && next.match(ref, username);
+      RefPatternMatcher next = getMatcher(expand(template, u));
+      return next != null ? next.match(expand(ref, u), username) : false;
     }
 
     boolean matchPrefix(String ref) {
       return ref.startsWith(prefix);
     }
+
+    private String expand(String parameterizedRef, String userName) {
+      if (parameterizedRef.contains("${")) {
+        return expand(new ParameterizedString(parameterizedRef), userName);
+      }
+      return parameterizedRef;
+    }
+
+    private String expand(ParameterizedString parameterizedRef, String userName) {
+      return parameterizedRef.replace(Collections.singletonMap("username",
+          userName));
+    }
   }
 }

gerrit-server/src/test/java/com/google/gerrit/server/project/RefControlTest.java

@@ -255,6 +255,13 @@ public class RefControlTest {
         u.controlForRef("refs/heads/master").canUpload());
   }
 
+  @Test
+  public void testUsernamePatternCanUploadToAnyRef() {
+    grant(local, PUSH, REGISTERED_USERS, "refs/heads/users/${username}/*");
+    ProjectControl u = util.user(local, "a-registered-user");
+    assertTrue("can upload", u.canPushToAtLeastOneRef() == Capable.OK);
+  }
+
   @Test
   public void testUsernamePatternNonRegex() {
     allow(local, READ, DEVS, "refs/sb/${username}/heads/*");