Commit 434180c7 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Merge branch 'fix-group-mention' into 'master'

Fix mentioning of private groups.

`issue.participants` would mistakenly not send the `current_user` to `mentioned_users`, which means it would search for referenced groups and users as if the user was signed out. Since signed out users don't have access to private groups (groups without public projects) and since you can't reference a group you don't have access to (since this would leak its existence), the group reference wasn't found and the group members weren't notified.

Addresses internal issue https://dev.gitlab.org/gitlab/gitlabhq/issues/2326.

See merge request !654
parents 5619c7b9 e7eee3b7
...@@ -58,6 +58,7 @@ v 7.11.0 (unreleased) ...@@ -58,6 +58,7 @@ v 7.11.0 (unreleased)
- Fix automatic blocking of auto-created users from Active Directory. - Fix automatic blocking of auto-created users from Active Directory.
- Call merge request web hook for each new commits (Arthur Gautier) - Call merge request web hook for each new commits (Arthur Gautier)
- Use SIGKILL by default in Sidekiq::MemoryKiller - Use SIGKILL by default in Sidekiq::MemoryKiller
- Fix mentioning of private groups.
v 7.10.2 v 7.10.2
- Fix CI links on MR page - Fix CI links on MR page
......
...@@ -42,10 +42,10 @@ module Mentionable ...@@ -42,10 +42,10 @@ module Mentionable
SystemNoteService.cross_reference_exists?(target, local_reference) SystemNoteService.cross_reference_exists?(target, local_reference)
end end
def mentioned_users(current_user = nil, p = project) def mentioned_users(current_user = nil)
return [] if mentionable_text.blank? return [] if mentionable_text.blank?
ext = Gitlab::ReferenceExtractor.new(p, current_user) ext = Gitlab::ReferenceExtractor.new(self.project, current_user)
ext.analyze(mentionable_text) ext.analyze(mentionable_text)
ext.users.uniq ext.users.uniq
end end
......
...@@ -40,7 +40,7 @@ module Participable ...@@ -40,7 +40,7 @@ module Participable
meth = method(attr) meth = method(attr)
value = value =
if meth.arity == 1 if meth.arity == 1 || meth.arity == -1
meth.call(current_user) meth.call(current_user)
else else
meth.call meth.call
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment