Add permission checking to UserReferenceFilter

lib/gitlab/markdown/user_reference_filter.rb

@@ -78,12 +78,16 @@ module Gitlab
             %(<a href="#{url}" class="#{klass}">@#{user}</a>)
           elsif namespace = Namespace.find_by(path: user)
             if namespace.is_a?(Group)
+              if user_can_read_group?(namespace)
                 url = group_url(user, only_path: context[:only_path])
+                %(<a href="#{url}" class="#{klass}">@#{user}</a>)
               else
-              url = user_url(user, only_path: context[:only_path])
+                match
               end
-
+            else
+              url = user_url(user, only_path: context[:only_path])
               %(<a href="#{url}" class="#{klass}">@#{user}</a>)
+            end
           else
             match
           end
@@ -112,6 +116,11 @@ module Gitlab
         h.namespace_project_url(project.namespace, project,
                                 only_path: context[:only_path])
       end
+
+      def user_can_read_group?(group)
+        return false if context[:current_user].blank?
+        Ability.abilities.allowed?(context[:current_user], :read_group, group)
+      end
     end
   end
 end

spec/lib/gitlab/markdown/user_reference_filter_spec.rb

@@ -47,13 +47,23 @@ module Gitlab::Markdown
       end
     end
 
-    it 'links to a Group' do
-      group = create(:group)
+    context 'mentioning a group' do
+      let(:group) { create(:group) }
+      let(:user)  { create(:user) }
+
+      it 'links to a Group that the current user can read' do
+        group.add_user(user, Gitlab::Access::DEVELOPER)
 
-      doc = filter("Hey @#{group.name}")
+        doc = filter("Hey @#{group.name}", current_user: user)
         expect(doc.css('a').first.attr('href')).to eq urls.group_url(group)
       end
 
+      it 'ignores references to a Group that the current user cannot read' do
+        doc = filter("Hey @#{group.name}", current_user: user)
+        expect(doc.to_html).to eq "Hey @#{group.name}"
+      end
+    end
+
     it 'links with adjacent text' do
       doc = filter("Mention me (@#{user.username}.)")
       expect(doc.to_html).to match(/\(<a.+>@#{user.username}<\/a>\.\)/)