Do not throw away random bytes from the CSPRNG

The older code generated LEN bytes of cryptography-safe random data
and applied the base64 encoding on top of that. The base64
transformation, however, inflates the size of the data by 33%, and
this means that only 9 bytes of randomness were actually used.

Unless the goal was to discard some of the CSPRNG output to make sure
that we do not leak too much stuff to a possible attacker, of course
("attacker" == "user generating passwords"). If that is the case, let
me know and I'll send a patch clarifying that this is by design.

Change-Id: Ie90ccc8012b3f6b9f80b74b879b713bc6959a874
Increase the size of HTTP passwords

These passwords are generated on the server side, and a regular user
has no way of increasing their length unless they ask an admin which
is actually capable of setting them as an arbitrary string. The
default length of just 12 characters might not be that much by today's
standards. Password storage is cheap, and 31 random bytes mean 42
characters as a result, which is of course THE number to use.

Change-Id: If70bf233aeb34bce46aa5a7d56f3bd64e0d108f3
Consider rule action while constructing local owners list

Previously rule action was not considered during computation of local
owners list in ProjectState. This means that members of group that was
added to OWNER permission with BLOCK or DENY action were considered as
project owners.

This patch fixes this security breach. Now groups assigned to OWNER
permission with BLOCK or DENY action will not be recognized as owners

Change-Id: I048f52d7b23b55c9e8843c5b2c9907b3326c8d40
Signed-off-by: Dariusz Luksza <dariusz@luksza.org>
Merge "Consider rule action while constructing local owners list" into stable-2.9
Update system group documentation

Administrators and batch users are not system groups any more, and
the identity of system groups cannot be set in `system_config`.

Change-Id: I1ec4d3e316115a669362d670f6e1eb7107aa2848
Remove 'send email' checkbox from reply box on change screen

When replying to a change the 'send email' checkbox allowed to control
if the change update should trigger email notifications for other
users. This behaviour is bad for people who want to rely on email
notifications since it depends on the replying users whether they get
an email notification or not. By removing the 'send email' checkbox
people are again in control about their own email notifications, e.g.
by the watch settings they can configure which emails they want to
receive. Still suppressing email notifications via the REST API is
possible (and wanted, e.g. for CI jobs).

Change-Id: If11863da6020a1d5b7edc1ae1a1a60399b197267
Signed-off-by: Edwin Kempin <edwin.kempin@sap.com>
(cherry picked from commit 00aa3bfb977faf6e70f58a99bbba5ba4d77ab8c3)
Fix incorrect submodule subscriptions

The gitlinks update fails after deleting a branch in a super project
which has other branches subscribed to the same submodule branch.

How to reproduce:
1. subscribe two branches in a super project to the same submodule
branch
2. delete one of the branches in the super project
3. push a change to the subscribed submodule branch

Proposed fixes:
Delete submodule subscriptions when deleting a branch via UI or Git wire
protocol.
Delete incorrect subscriptions when the gitlinks update fails in
SubmoduleOp.

Bug: Issue 2989
Change-Id: I91bbdffa0770eb1754efc6cb7f1549e7dab5c3ce
Fix quoted-printable encoding of e-mail addresses

When the RFC2047-style escapes are used for e-mail headers, only a
limited subset of characters is allowed to be passed unescaped. This is
governed by the "phrase" production in RFC 2047, section 5, case (3),
see [1].

In real world, this manifested as silently truncating the "(Code Review)"
part of the e-mail address when the author's name was not pure ASCII
(/me waves). Both of the two most popular open source IMAP servers,
Dovecot and Cyrus, interpret these Gerrit e-mails as having a
RFC5322-style comment, and therefore that part effectively gets lost.
GMail, on the other hand, shows this comment as a part of the From
address.

The change involved some refactoring of the way quoted-printable encoder
works. Working on Unicode code points one at a time is easier in this
context. It would be cool to delegate this altogether to some real
library, but org.apache.commons.codec.net.QuotedPrintableCodec doesn't
solve anything (it doesn't even bother to pretend that it talks
RFC2047), and I don't think I could get away with introducing JavaMail
as a dependency in a patch release.

[1] https://tools.ietf.org/html/rfc2047#section-5

Change-Id: I77452728f9b55a16bc9bd65208c187c44ce43153
Merge changes If70bf233,Ie90ccc80 into stable-2.9

* changes:
  Increase the size of HTTP passwords
  Do not throw away random bytes from the CSPRNG
Merge "Fix incorrect submodule subscriptions" into stable-2.9
Merge "Remove 'send email' checkbox from reply box on change screen" into stable-2.9
Merge "Fix quoted-printable encoding of e-mail addresses" into stable-2.9
Fix SubmoduleOp tests

Patch set 31 of change I91bbdffa added an optimisation to prevent an
unnecessary call to submoduleSubscriptions().delete(), but neglected
to update the unit test mock expectations, thus causing them to fail.

Remove unneeded expect() calls in the unit tests.

Also, in future, remember to always run the unit tests again even if
"only making a trivial change" :(

Change-Id: I2d15c69028812a1a11382e854377605c404b3044
Merge branch 'stable-2.9' into stable-2.10

* stable-2.9:
  Fix SubmoduleOp tests
  Fix quoted-printable encoding of e-mail addresses
  Fix incorrect submodule subscriptions
  Remove 'send email' checkbox from reply box on change screen
  Update system group documentation
  Consider rule action while constructing local owners list
  Increase the size of HTTP passwords
  Do not throw away random bytes from the CSPRNG

Conflicts:
	gerrit-server/src/main/java/com/google/gerrit/server/git/ReceiveCommits.java
	gerrit-server/src/main/java/com/google/gerrit/server/git/SubmoduleOp.java
	gerrit-server/src/test/java/com/google/gerrit/server/git/SubmoduleOpTest.java

Change-Id: If086a9021aabb512023753d8dea59f50799cd91a
Remove 2.9.2 fix from 2.10 release notes

"Remove 'send email' checkbox from reply box on change screen" is
included in 2.9.2 and should not be listed in the 2.10 release
notes.

Change-Id: Ifa6b3dcfa01d30148f33859402e0bafd7dbd1c26