This patch makes standard post-build action refuse to let you configure a downstream project you cannot currently build.
The one from parameterized-trigger will show an error in the configure screen but still lets you save the configuration; needs an analogous patch to that plugin.
Does not yet protect against POSTing config.xml with the trigger.

(cherry picked from commit 11eb4c72)

<script> added via innerText doesn't get executed by itself, so we need
to handle them separately in renderOnDemand
(cherry picked from commit ee43b8e7)

Conflicts:
	test/src/test/java/lib/layout/RenderOnDemandTest.java

https://ci.jenkins-ci.org/job/jenkins_rc_branch/285/testReport/hudson.tasks.junit/SuiteResultTest/sizeSurefire/ failed at 4 over.
(cherry picked from commit b47cb5d2)

Conflicts:
	test/src/test/java/hudson/tasks/junit/SuiteResultTest.java

Verifying that the heap size of a SuiteResult (from Surefire) is linear in the sizes of TEST-*.xml + *-output.txt even when there is lots of stdio.(cherry picked from commit 9f22e33e)

Conflicts:
	test/src/main/java/org/jvnet/hudson/test/MemoryAssert.java

(cherry picked from commit 6f7891f3)

Conflicts:
	core/src/main/java/hudson/widgets/RenderOnDemandClosure.java

(cherry picked from commit 7e8bf72e)

Conflicts:
	changelog.html

The updated version uses the locally cached timestamp, '.timestamp', to set the
'If-Modified-Since' header. 304 Not Modified responses are dealt with by
aborting the installation.
(cherry picked from commit 35f7653b)

Conflicts:
	core/src/test/java/hudson/FilePathTest.java

[JENKINS-16341] INSANE testing shows that a RenderOnDemandClosure binding adds about 380k, with or wothout 08efdf5d.(cherry picked from commit f178f0ce)

Conflicts:
	test/src/main/java/org/jvnet/hudson/test/MemoryAssert.java
	test/src/test/java/lib/layout/RenderOnDemandTest.java

(cherry picked from commit 08efdf5d)

Conflicts:
	changelog.html
	core/src/main/java/hudson/widgets/RenderOnDemandClosure.java

This change does not necessarily improve total performance, since the avatar is still computed.
But (1) the computation is correctly done in the work thread, not in the HTTP response thread;
(2) the computation is done just once for a given User, which could reduce load when many AJAX checks are done.(cherry picked from commit c757e654)

Conflicts:
	changelog.html

(cherry picked from commit 8a4bedd0)

Conflicts:
	changelog.html
	pom.xml

[FIXED JENKINS-16319] Stream ordering problem prevented SecretRewriter from working on Windows.(cherry picked from commit 8b823110)

Conflicts:
	changelog.html

First, display instructions when the user has CONNECT, not necessarily ADMINISTER.
Second, when anonymous users cannot CONNECT, show how to use -jnlpCredentials
(and do not bother showing javaws, since it does not work in this case).(cherry picked from commit a1e709dd)

Conflicts:
	changelog.html

(cherry picked from commit b8078947)

Conflicts:
	changelog.html

(cherry picked from commit 76e31a3a)

Conflicts:
	pom.xml

changelog entry for JENKINS-16278(cherry picked from commit 0b5a4a35)

Conflicts:
	changelog.html

New cookie signature generation was not implemented in creation of RememberMe cookie, but only in its verification.
Fixed by new override TokenBasedRememberMeServices2.loginSuccess
(cherry picked from commit 91bbae3c)

[FIXED JENKINS-16397] Just displaying /asynchPeople constructed the expensive People object merely to decide whether or not to display the “REST API” link.
(cherry picked from commit 063acce1)

Conflicts:
	changelog.html

[FIXED JENKINS-16244] View.hasPeople too slow to use in sidepanel.jelly.(cherry picked from commit 73aac107)

Conflicts:
	changelog.html

Solves the issue for newly created builds by not attempting to persist the original file upload record, which is useless after the build has run (the fileParameters dir in the build already archives them).
Does not help loading pre-fix builds in which the upload temp file has been deleted; for these, you must manually delete <file class="org.apache.commons.fileupload.disk.DiskFileItem" serialization="custom">…</file> from the build.xml.
(Did not find a straightforward way to just instruct XStream to ignore this bit of XML: it is easy to avoid serializing a field, but deserializing is different.)(cherry picked from commit 4dde24e6)

Conflicts:
	changelog.html

(cherry picked from commit a156f1eb)

Conflicts:
	changelog.html

(cherry picked from commit 2f1ad0b2)

Conflicts:
	changelog.html

[FIXED JENKINS-15335] Typo broke build queue display.(cherry picked from commit 6c4e65f5)

From what I was told by Emanuele today in the office hours, this came up
during the Copenhagen hackathon.
(cherry picked from commit f1aa7ba0)

Conflicts:
	changelog.html

now it is done properly on Javascript side so the current server
implementation triggers javascript errors.

Result can be observed on DynamicComboBox within ui-samples-plugin(cherry picked from commit b6ce0387)

Conflicts:
	changelog.html

If the user still has the API token that's generated from secret.key,
don't accept that.

Hopefully this is the last fix
(cherry picked from commit 94a8789b)

If JENKINS_HOME is created by a post SECURIT-49 Jenkins (LTS, and other
variants), then there's no need to alarm the user.
(cherry picked from commit 3dc13b95)

This is because we discovered some plugins that use Secret early on in
the initialization.
(cherry picked from commit c3d8e05a)

As an AdministrativeMonitor, it shows up in the manage Jenkins UI, and
allows the administrator to run a re-keying operation.
(cherry picked from commit 4895eaaf)

We are replacing it by the ConfidentialStore class and the
ConfidentialKey class, which provides purpose-specific confidential
information that are separated from each other.

In this way, not all eggs are in one basket, and in case of a
compromise, the impact will contained.

Also replaced several insecure use of digest(secret|messsage) or
digest(message|secret) by HMAC.
(cherry picked from commit a9aff088)

Conflicts:

	core/src/main/java/hudson/DNSMultiCast.java
	core/src/main/java/hudson/model/Job.java
	core/src/main/java/hudson/model/UsageStatistics.java

(On trunk these commits are done separately as
72c68a22
45b8f82e
31d2e03d

(cherry picked from commit 43ff1688)