Only permit current patch set to edit the commit message

Do not allow users to replace a more recent patch set with an older
patch set when there is a race between the web UI and the command
line git client:

 1. Upload a new change (Patch Set 1)
 2. Open the code review page in a browser
 3. Upload a second version of the change (Patch Set 2)

 4. Without refreshing the code review page, so that it's still
    showing Patch Set 1, click the Edit Message button, change the
    commit message, and hit save.

 5. Note that this has created a Patch Set 3 with file contents taken
    from Patch Set 1 but the edited message.

Change-Id: I73af89989b72d9e702061b3746390df68cef4b62

1 files changed, 5 insertions, 0 deletions

diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java b/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java
index a634b7ccd6..c1dbc177b3 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java
@@ -82,6 +82,11 @@ class EditMessage implements RestModifyView<RevisionResource, Input>,
       OrmException, ResourceNotFoundException, IOException {
     if (Strings.isNullOrEmpty(input.message)) {
       throw new BadRequestException("message must be non-empty");
+    } else if (!rsrc.getPatchSet().getId()
+        .equals(rsrc.getChange().currentPatchSetId())) {
+      throw new ResourceConflictException(String.format(
+          "revision %s is not current revision",
+          rsrc.getPatchSet().getRevision().get()));
     }
 
     final Repository git;