Only permit current patch set to edit the commit message

Do not allow users to replace a more recent patch set with an older
patch set when there is a race between the web UI and the command
line git client:

 1. Upload a new change (Patch Set 1)
 2. Open the code review page in a browser
 3. Upload a second version of the change (Patch Set 2)

 4. Without refreshing the code review page, so that it's still
    showing Patch Set 1, click the Edit Message button, change the
    commit message, and hit save.

 5. Note that this has created a Patch Set 3 with file contents taken
    from Patch Set 1 but the edited message.

Change-Id: I73af89989b72d9e702061b3746390df68cef4b62

gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java

diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java b/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java
index a634b7c..c1dbc17 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/change/EditMessage.java
@@ -82,6 +82,11 @@
       OrmException, ResourceNotFoundException, IOException {
     if (Strings.isNullOrEmpty(input.message)) {
       throw new BadRequestException("message must be non-empty");
+    } else if (!rsrc.getPatchSet().getId()
+        .equals(rsrc.getChange().currentPatchSetId())) {
+      throw new ResourceConflictException(String.format(
+          "revision %s is not current revision",
+          rsrc.getPatchSet().getRevision().get()));
     }
 
     final Repository git;