diff --git a/src/main/java/com/googlesource/gerrit/plugins/xdocs/XDocServlet.java b/src/main/java/com/googlesource/gerrit/plugins/xdocs/XDocServlet.java
index 9a69e96..3fd86ba 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/xdocs/XDocServlet.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/xdocs/XDocServlet.java
@@ -32,10 +32,13 @@
 import com.google.gerrit.httpd.resources.Resource;
 import com.google.gerrit.httpd.resources.SmallResource;
 import com.google.gerrit.reviewdb.client.Project;
-import com.google.gerrit.reviewdb.server.ReviewDb;
 import com.google.gerrit.server.change.FileContentUtil;
 import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.mime.FileTypeRegistry;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackendException;
+import com.google.gerrit.server.permissions.RefPermission;
+import com.google.gerrit.server.project.CommitsCollection;
 import com.google.gerrit.server.project.GetHead;
 import com.google.gerrit.server.project.NoSuchProjectException;
 import com.google.gerrit.server.project.ProjectCache;
@@ -73,7 +76,6 @@
   public static final String PATH_PREFIX = "/project/";
 
   private final String pluginName;
-  private final Provider<ReviewDb> db;
   private final ProjectControl.Factory projectControlFactory;
   private final ProjectCache projectCache;
   private final Provider<GetHead> getHead;
@@ -82,11 +84,12 @@
   private final FileTypeRegistry fileTypeRegistry;
   private final XDocProjectConfig.Factory cfgFactory;
   private final Formatters formatters;
+  private final CommitsCollection commits;
+  private final PermissionBackend permissionBackend;
 
   @Inject
   XDocServlet(
       @PluginName String pluginName,
-      Provider<ReviewDb> db,
       ProjectControl.Factory projectControlFactory,
       ProjectCache projectCache,
       Provider<GetHead> getHead,
@@ -94,9 +97,10 @@
       XDocCache cache,
       FileTypeRegistry fileTypeRegistry,
       XDocProjectConfig.Factory cfgFactory,
-      Formatters formatters) {
+      Formatters formatters,
+      CommitsCollection commits,
+      PermissionBackend permissionBackend) {
     this.pluginName = pluginName;
-    this.db = db;
     this.projectControlFactory = projectControlFactory;
     this.projectCache = projectCache;
     this.getHead = getHead;
@@ -105,6 +109,8 @@
     this.fileTypeRegistry = fileTypeRegistry;
     this.cfgFactory = cfgFactory;
     this.formatters = formatters;
+    this.commits = commits;
+    this.permissionBackend = permissionBackend;
   }
 
   @Override
@@ -121,7 +127,7 @@
         return;
       }
 
-      MimeType mimeType = fileTypeRegistry.getMimeType(key.file, null);
+      MimeType mimeType = fileTypeRegistry.getMimeType(key.file, (byte[]) null);
       mimeType =
           new MimeType(
               FileContentUtil.resolveContentType(
@@ -129,7 +135,7 @@
       FormatterProvider formatter = getFormatter(req, key, mimeType);
       validateDiffMode(key);
 
-      ProjectControl projectControl = projectControlFactory.validateFor(key.project);
+      ProjectControl projectControl = projectControlFactory.controlFor(key.project);
       String rev =
           getRevision(
               key.diffMode == DiffMode.NO_DIFF
@@ -191,6 +197,8 @@
     } catch (MethodNotAllowedException e) {
       CacheHeaders.setNotCacheable(res);
       res.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+    } catch (PermissionBackendException e) {
+      //
     }
   }
 
@@ -289,7 +297,7 @@
   }
 
   private String getRevision(String revision, ProjectControl projectControl)
-      throws ResourceNotFoundException, AuthException, IOException {
+      throws ResourceNotFoundException, AuthException, IOException, PermissionBackendException {
     if (revision == null) {
       return null;
     }
@@ -305,7 +313,14 @@
     if (!rev.startsWith(Constants.R_REFS)) {
       rev = Constants.R_HEADS + rev;
     }
-    if (!projectControl.controlForRef(rev).isVisible()) {
+    try {
+      permissionBackend
+          .user(projectControl.getUser())
+          .project(projectControl.getProject().getNameKey())
+          .ref(rev)
+          .check(RefPermission.READ);
+    } catch (AuthException e) {
+      // Don't leak the project's existence
       throw new ResourceNotFoundException();
     }
     return rev;
@@ -328,7 +343,8 @@
       throws ResourceNotFoundException, IOException {
     try (RevWalk rw = new RevWalk(repo)) {
       RevCommit commit = rw.parseCommit(revId);
-      if (!projectControl.canReadCommit(db.get(), repo, commit)) {
+      ProjectState state = projectControl.getProjectState();
+      if (!commits.canRead(state, repo, commit)) {
         throw new ResourceNotFoundException();
       }
     }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/xdocs/client/ChangeInfo.java b/src/main/java/com/googlesource/gerrit/plugins/xdocs/client/ChangeInfo.java
index 44ea4c6..97a5867 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/xdocs/client/ChangeInfo.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/xdocs/client/ChangeInfo.java
@@ -46,13 +46,7 @@
   }
 
   public final boolean isOpen() {
-    switch (getStatus()) {
-      case NEW:
-      case DRAFT:
-        return true;
-      default:
-        return false;
-    }
+    return getStatus() == ChangeStatus.NEW;
   }
 
   protected ChangeInfo() {}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/Formatters.java b/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/Formatters.java
index da56201..def2f5b 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/Formatters.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/xdocs/formatter/Formatters.java
@@ -80,7 +80,7 @@
   public FormatterProvider get(ProjectState project, String fileName) {
     XDocGlobalConfig globalCfg =
         new XDocGlobalConfig(pluginCfgFactory.getGlobalPluginConfig(pluginName));
-    MimeType mimeType = fileTypeRegistry.getMimeType(fileName, null);
+    MimeType mimeType = fileTypeRegistry.getMimeType(fileName, (byte[]) null);
     mimeType =
         new MimeType(
             FileContentUtil.resolveContentType(