Merge commit '16f2c7af0122a4f3cfd709bd44d9b5402a6ec8bf' into security
Updating branch base to 1.532.
Missing import.
Let netbeans.compile.on.save revert to its default.
Seems to work in 8.0 at least for some functional tests.
Developers can always disable it privately if they run into issues.
(cherry picked from commit 7b420175222458c4b5fbda247ef3c8a221bc6827)

Conflicts:
	pom.xml
[FIXED SECURITY-131] Recode restOfPath before constructing URLs from it, so it cannot be used for directory traversal.
Do not redirectTestOutputToFile when we are running an individual test (suite or case).
In this case we are probably interested in looking at the output as it arrives in real time.
Can always be overridden on the command line if desired.
(cherry picked from commit 44a8ec110459e560a79c0f11883841bd7095f723)
[FIXED SECURITY-155] Do not allow plugin code to be downloaded via doDynamic, only static resources.
[FIXED SECURITY-143]

Coerce the parameter value to one of a legal value
[FIXED SECURITY-138]

Protect default password value from users who are triggering builds.
[FIXED SECURITY-149]

ZeroClipboard 1.3.5 is rather incompatible with 1.1.7, and various API changes were needed.

 - setText() call doesn't work until the DOM is populated, which is at some unknown time AFAICT.
   installing it via the datarequested event avoids this problem.
 - constructor now demands the element to attach to, and it's unclear if relative positioning is working or not.
 - "display: inline-block" is needed for ZeroClipboard to correctly compute the height of the element
[FIXED SECURITY-87]

Don't wait for a connection forever, which can cause the thread to hang forever if the upload link never arrives
[FIXED SECURITY-110]

Don't let UsernameNotFoundException vs BadCredentialsException
difference to be seen by the caller, for that tells whether the user
exists or not.

But to assist trouble-shooting, do report that error to the server. UUID
helps the user finds the information in the log file
[FIXED SECURITY-120]

If Jenkins URL is set to https, force the secure flag. Also force the
cookie to be HTTP only, which mitigates the damage that XSS can cause.

See https://www.owasp.org/index.php/SecureFlag
[SECURITY-87] No apparent reason for CONNECTION_TIMEOUT to be public.
[SECURITY-120] Do not print a warning with stack trace just because we are using a 2.x servlet container.
[FIXED SECURITY-128]

It may be that the 'newName' exists and just not visible to the user trying to do a rename
[SECURITY-87]

After talking to Jesse, he's OK with me bringing it back to public so
long as we don't allow other programmatic dependencies to it.

The intention of leaving them mutable is to allow admins to play with
this in the groovy script during the initialization and at runtime.

Groovy currently ignores the private access modifier anyway, but that is
considered as a bug in the upstream
(https://jira.codehaus.org/browse/GROOVY-3010)
[FIXED SECURITY-127]

CONFIGURE permission shouldn't allow the type of the job to be changed.
That's more of CREATE+DELETE.

In any case, the code doesn't correctly handling submitting config.xml
for a different type.
[SECURITY-128]

Plugins that depend on LTS shouldn't be using this API.
[FIXED SECURITY-122]

Added "X-Content-Type-Options: nosniff" for serving user-generated
contents to improve security a little bit
maven plugin is moved off to a separate repository.

See https://github.com/jenkinsci/maven-plugin

(cherry picked from commit f98070d3e6dabab0817f80f2526f78f61ffa1c83)

Conflicts:
	maven-plugin/pom.xml
	maven-plugin/src/main/java/hudson/maven/AbstractMavenProcessFactory.java
	maven-plugin/src/main/java/hudson/maven/MavenModuleSetBuild.java
	maven-plugin/src/main/java/hudson/maven/MavenProcessFactory.java
	maven-plugin/src/main/resources/hudson/maven/MavenModuleSet/configure-entries.jelly
	plugins/pom.xml
	pom.xml