[FIXED SECURITY-127]

CONFIGURE permission shouldn't allow the type of the job to be changed.
That's more of CREATE+DELETE.

In any case, the code doesn't correctly handling submitting config.xml
for a different type.

core/src/main/java/hudson/model/AbstractItem.java

@@ -603,7 +603,13 @@ public abstract class AbstractItem extends Actionable implements Item, HttpDelet
             }
 
             // try to reflect the changes by reloading
-            new XmlFile(Items.XSTREAM, out.getTemporaryFile()).unmarshal(this);
+            Object o = new XmlFile(Items.XSTREAM, out.getTemporaryFile()).unmarshal(this);
+            if (o!=this) {
+                // ensure that we've got the same job type. extending this code to support updating
+                // to different job type requires destroying & creating a new job type
+                throw new IOException("Expecting "+this.getClass()+" but got "+o.getClass()+" instead");
+            }
+
             Items.updatingByXml.set(true);
             try {
                 onLoad(getParent(), getRootDir().getName());