Merge branch 'stable-2.13'

* stable-2.13:
  Update 2.11.10 release notes to use asciidoctor style sections
  Fix a possible NPE in HiddenErrorHandler
  PluginDaemonTest: Expose plugin name
  Set version to 2.11.10
  Release notes for Gerrit 2.11.10
  Fix typo in 2.12.4 release notes
  AgreementsIT: Add test for creating new change without CLA
  CherryPick: Don't allow to create commit without CLA
  Revert: Don't allow to create revert commit without CLA
  Do not indent first line of Capable message
  Add configuration of key exchange algorithms for sshd

Change-Id: Ic9f32517c49c13d9cd77882fa6090dd2bff6f696

ReleaseNotes/ReleaseNotes-2.11.10.txt

@@ -0,0 +1,28 @@
+= Release notes for Gerrit 2.11.10
+
+Gerrit 2.11.10 is now available:
+
+link:https://gerrit-releases.storage.googleapis.com/gerrit-2.11.10.war[
+https://gerrit-releases.storage.googleapis.com/gerrit-2.11.10.war]
+
+There are no schema changes from link:ReleaseNotes-2.11.9.html[2.11.9].
+
+== Bug Fixes
+
+* Fix synchronization of Myers diff and Histogram diff invocations.
++
+The fix for
+link:https://code.google.com/p/gerrit/issues/detail?id=3361[Issue 3361]
+that was included in Gerrit versions 2.10.7 and 2.11.4 introduced a
+regression that prevented more than one file header diff from being
+computed at the same time across the entire server.
+
+* Fix `sshd.idleTimeout` setting being ignored.
++
+The `sshd.idleTimeout` setting was not being correctly set on the SSHD
+backend, causing idle sessions to not time out.
+
+* Add the correct license for AsciiDoctor.
++
+AsciiDoctor is licensed under the MIT License, not Apache2 as previously
+documented.

ReleaseNotes/ReleaseNotes-2.12.4.txt

@@ -93,7 +93,7 @@ Fix 'Cannot format velocity template' error when sending notification emails.
 
 * Fix `sshd.idleTimeout` setting being ignored.
 +
-Ths `sshd.idleTimeout` setting was not being correctly set on the SSHD
+The `sshd.idleTimeout` setting was not being correctly set on the SSHD
 backend, causing idle sessions to not time out.
 
 * link:https://bugs.chromium.org/p/gerrit/issues/detail?id=4324[Issue 4324]:

ReleaseNotes/index.txt

@@ -14,6 +14,7 @@
 
 [[s2_11]]
 == Version 2.11.x
+* link:ReleaseNotes-2.11.10.html[2.11.10]
 * link:ReleaseNotes-2.11.9.html[2.11.9]
 * link:ReleaseNotes-2.11.8.html[2.11.8]
 * link:ReleaseNotes-2.11.7.html[2.11.7]

gerrit-acceptance-tests/src/test/java/com/google/gerrit/acceptance/api/accounts/AgreementsIT.java

@@ -16,18 +16,31 @@ package com.google.gerrit.acceptance.api.accounts;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.TruthJUnit.assume;
+import static java.util.concurrent.TimeUnit.SECONDS;
 
 import com.google.gerrit.acceptance.AbstractDaemonTest;
 import com.google.gerrit.common.data.ContributorAgreement;
+import com.google.gerrit.extensions.api.changes.CherryPickInput;
+import com.google.gerrit.extensions.api.changes.ReviewInput;
+import com.google.gerrit.extensions.api.changes.SubmitInput;
+import com.google.gerrit.extensions.api.projects.BranchInfo;
+import com.google.gerrit.extensions.api.projects.BranchInput;
+import com.google.gerrit.extensions.client.InheritableBoolean;
 import com.google.gerrit.extensions.common.AgreementInfo;
+import com.google.gerrit.extensions.common.ChangeInfo;
+import com.google.gerrit.extensions.common.ChangeInput;
 import com.google.gerrit.extensions.common.ServerInfo;
+import com.google.gerrit.extensions.restapi.AuthException;
 import com.google.gerrit.extensions.restapi.BadRequestException;
 import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
 import com.google.gerrit.extensions.restapi.UnprocessableEntityException;
 import com.google.gerrit.testutil.ConfigSuite;
+import com.google.gerrit.testutil.TestTimeUtil;
 
 import org.eclipse.jgit.lib.Config;
+import org.junit.AfterClass;
 import org.junit.Before;
+import org.junit.BeforeClass;
 import org.junit.Test;
 
 import java.util.List;
@@ -43,6 +56,16 @@ public class AgreementsIT extends AbstractDaemonTest {
     return cfg;
   }
 
+  @BeforeClass
+  public static void setTimeForTesting() {
+    TestTimeUtil.resetWithClockStep(1, SECONDS);
+  }
+
+  @AfterClass
+  public static void restoreTime() {
+    TestTimeUtil.useSystemTime();
+  }
+
   @Before
   public void setUp() throws Exception {
     caAutoVerify = configureContributorAgreement(true);
@@ -117,6 +140,70 @@ public class AgreementsIT extends AbstractDaemonTest {
     gApi.accounts().self().listAgreements();
   }
 
+  @Test
+  public void revertChangeWithoutCLA() throws Exception {
+    assume().that(isContributorAgreementsEnabled()).isTrue();
+
+    // Create a change succeeds when agreement is not required
+    setUseContributorAgreements(InheritableBoolean.FALSE);
+    ChangeInfo change = gApi.changes().create(newChangeInput()).get();
+
+    // Approve and submit it
+    setApiUser(admin);
+    gApi.changes().id(change.changeId).current().review(ReviewInput.approve());
+    gApi.changes().id(change.changeId).current().submit(new SubmitInput());
+
+    // Revert is not allowed when CLA is required but not signed
+    setApiUser(user);
+    setUseContributorAgreements(InheritableBoolean.TRUE);
+    exception.expect(AuthException.class);
+    exception.expectMessage("A Contributor Agreement must be completed");
+    gApi.changes().id(change.changeId).revert();
+  }
+
+  @Test
+  public void cherrypickChangeWithoutCLA() throws Exception {
+    assume().that(isContributorAgreementsEnabled()).isTrue();
+
+    // Create a new branch
+    setApiUser(admin);
+    BranchInfo dest = gApi.projects().name(project.get())
+        .branch("cherry-pick-to").create(new BranchInput()).get();
+
+    // Create a change succeeds when agreement is not required
+    setUseContributorAgreements(InheritableBoolean.FALSE);
+    ChangeInfo change = gApi.changes().create(newChangeInput()).get();
+
+    // Approve and submit it
+    gApi.changes().id(change.changeId).current().review(ReviewInput.approve());
+    gApi.changes().id(change.changeId).current().submit(new SubmitInput());
+
+    // Cherry-pick is not allowed when CLA is required but not signed
+    setApiUser(user);
+    setUseContributorAgreements(InheritableBoolean.TRUE);
+    CherryPickInput in = new CherryPickInput();
+    in.destination = dest.ref;
+    in.message = change.subject;
+    exception.expect(AuthException.class);
+    exception.expectMessage("A Contributor Agreement must be completed");
+    gApi.changes().id(change.changeId).current().cherryPick(in);
+  }
+
+  @Test
+  public void createChangeWithoutCLA() throws Exception {
+    assume().that(isContributorAgreementsEnabled()).isTrue();
+
+    // Create a change succeeds when agreement is not required
+    setUseContributorAgreements(InheritableBoolean.FALSE);
+    gApi.changes().create(newChangeInput());
+
+    // Create a change is not allowed when CLA is required but not signed
+    setUseContributorAgreements(InheritableBoolean.TRUE);
+    exception.expect(AuthException.class);
+    exception.expectMessage("A Contributor Agreement must be completed");
+    gApi.changes().create(newChangeInput());
+  }
+
   private void assertAgreement(AgreementInfo info, ContributorAgreement ca) {
     assertThat(info.name).isEqualTo(ca.getName());
     assertThat(info.description).isEqualTo(ca.getDescription());
@@ -128,4 +215,12 @@ public class AgreementsIT extends AbstractDaemonTest {
       assertThat(info.autoVerifyGroup).isNull();
     }
   }
+
+  private ChangeInput newChangeInput() {
+    ChangeInput in = new ChangeInput();
+    in.branch = "master";
+    in.subject = "test";
+    in.project = project.get();
+    return in;
+  }
 }

gerrit-pgm/src/main/java/com/google/gerrit/pgm/http/jetty/HiddenErrorHandler.java

@@ -64,10 +64,15 @@ class HiddenErrorHandler extends ErrorHandler {
   }
 
   private static byte[] message(HttpConnection conn) {
-    String msg = conn.getHttpChannel().getResponse().getReason();
-    if (msg == null) {
-      msg = HttpStatus.getMessage(conn.getHttpChannel()
-          .getResponse().getStatus());
+    String msg;
+    if (conn == null) {
+      msg = "";
+    } else {
+      msg = conn.getHttpChannel().getResponse().getReason();
+      if (msg == null) {
+        msg = HttpStatus.getMessage(conn.getHttpChannel()
+            .getResponse().getStatus());
+      }
     }
     return msg.getBytes(ISO_8859_1);
   }

gerrit-server/src/main/java/com/google/gerrit/server/change/CherryPick.java

@@ -14,6 +14,7 @@
 
 package com.google.gerrit.server.change;
 
+import com.google.gerrit.common.data.Capable;
 import com.google.gerrit.extensions.api.changes.CherryPickInput;
 import com.google.gerrit.extensions.common.ChangeInfo;
 import com.google.gerrit.extensions.restapi.AuthException;
@@ -30,6 +31,7 @@ import com.google.gerrit.server.git.UpdateException;
 import com.google.gerrit.server.project.ChangeControl;
 import com.google.gerrit.server.project.InvalidChangeOperationException;
 import com.google.gerrit.server.project.NoSuchChangeException;
+import com.google.gerrit.server.project.ProjectControl;
 import com.google.gerrit.server.project.RefControl;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.Inject;
@@ -71,8 +73,14 @@ public class CherryPick implements RestModifyView<RevisionResource, CherryPickIn
       throw new AuthException("Cherry pick not permitted");
     }
 
+    ProjectControl projectControl = control.getProjectControl();
+    Capable capable = projectControl.canPushToAtLeastOneRef();
+    if (capable != Capable.OK) {
+      throw new AuthException(capable.getMessage());
+    }
+
     String refName = RefNames.fullName(input.destination);
-    RefControl refControl = control.getProjectControl().controlForRef(refName);
+    RefControl refControl = projectControl.controlForRef(refName);
     if (!refControl.canUpload()) {
       throw new AuthException("Not allowed to cherry pick "
           + revision.getChange().getId().toString() + " to "

gerrit-server/src/main/java/com/google/gerrit/server/change/Revert.java

@@ -16,6 +16,7 @@ package com.google.gerrit.server.change;
 
 import com.google.common.base.Strings;
 import com.google.gerrit.common.TimeUtil;
+import com.google.gerrit.common.data.Capable;
 import com.google.gerrit.extensions.api.changes.RevertInput;
 import com.google.gerrit.extensions.common.ChangeInfo;
 import com.google.gerrit.extensions.restapi.AuthException;
@@ -48,6 +49,7 @@ import com.google.gerrit.server.git.validators.CommitValidators;
 import com.google.gerrit.server.mail.RevertedSender;
 import com.google.gerrit.server.project.ChangeControl;
 import com.google.gerrit.server.project.NoSuchChangeException;
+import com.google.gerrit.server.project.ProjectControl;
 import com.google.gerrit.server.project.RefControl;
 import com.google.gwtorm.server.OrmException;
 import com.google.inject.Inject;
@@ -122,6 +124,13 @@ public class Revert implements RestModifyView<ChangeResource, RevertInput>,
       throws IOException, OrmException, RestApiException,
       UpdateException, NoSuchChangeException {
     RefControl refControl = req.getControl().getRefControl();
+    ProjectControl projectControl = req.getControl().getProjectControl();
+
+    Capable capable = projectControl.canPushToAtLeastOneRef();
+    if (capable != Capable.OK) {
+      throw new AuthException(capable.getMessage());
+    }
+
     Change change = req.getChange();
     if (!refControl.canUpload()) {
       throw new AuthException("revert not permitted");

gerrit-server/src/main/java/com/google/gerrit/server/project/ProjectControl.java

@@ -384,7 +384,7 @@ public class ProjectControl {
     }
 
     final StringBuilder msg = new StringBuilder();
-    msg.append(" A Contributor Agreement must be completed before uploading");
+    msg.append("A Contributor Agreement must be completed before uploading");
     if (canonicalWebUrl != null) {
       msg.append(":\n\n  ");
       msg.append(canonicalWebUrl);