Merge branch...

Merge branch 'security-377-private-subgroup-path-visible-in-epic-timeline-when-child-epic-is-added' into 'master'

Private subgroup path visible in epic timeline when child epic is added.

See merge request gitlab/gitlab-ee!1212

ee/app/models/ee/system_note_metadata.rb

@@ -14,7 +14,7 @@ module EE
     EE_TYPES_WITH_CROSS_REFERENCES = %w[
       relate unrelate
       epic_issue_added issue_added_to_epic epic_issue_removed issue_removed_from_epic
-      epic_issue_moved issue_changed_epic
+      epic_issue_moved issue_changed_epic relate_epic unrelate_epic
     ].freeze
 
     override :icon_types

ee/changelogs/unreleased/security-377-private-subgroup-path-visible-in-epic-timeline-when-child.yml

+---
+title: Do not show private cross references in epic notes
+merge_request:
+author:
+type: security

ee/spec/models/note_spec.rb

@@ -72,4 +72,17 @@ describe Note do
       end
     end
   end
+
+  describe '#cross_reference?' do
+    [:relate_epic, :unrelate_epic].each do |type|
+      it "delegates #{type} system note to the cross-reference regex" do
+        note = create(:note, :system)
+        create(:system_note_metadata, note: note, action: type)
+
+        expect(note).to receive(:matches_cross_reference_regex?).and_return(false)
+
+        note.cross_reference?
+      end
+    end
+  end
 end