Merge branch 'fix-unverified-email-badge' into 'master'

Prevent unauthorized display of GitLab employee badge

Closes #212618

See merge request gitlab-org/gitlab!28397

app/models/user.rb

@@ -1689,7 +1689,7 @@ class User < ApplicationRecord
   def gitlab_employee?
     strong_memoize(:gitlab_employee) do
       if Gitlab.com?
-        Mail::Address.new(email).domain == "gitlab.com"
+        Mail::Address.new(email).domain == "gitlab.com" && confirmed?
       else
         false
       end

spec/models/user_spec.rb

@@ -4400,6 +4400,12 @@ describe User, :do_not_mock_admin_mode do
 
       it { is_expected.to be expected_result }
     end
+
+    context 'when email is of Gitlab and is not confirmed' do
+      let(:user) { build(:user, email: 'test@gitlab.com', confirmed_at: nil) }
+
+      it { is_expected.to be false }
+    end
   end
 
   describe '#current_highest_access_level' do