Check for project read permissions in cross-references

1 files changed, 13 insertions, 3 deletions

diff --git a/lib/gitlab/markdown/cross_project_reference.rb b/lib/gitlab/markdown/cross_project_reference.rb
index 114247d0a33..b2197432caa 100644
--- a/lib/gitlab/markdown/cross_project_reference.rb
+++ b/lib/gitlab/markdown/cross_project_reference.rb
@@ -8,19 +8,29 @@ module Gitlab
 
       # Given a cross-project reference string, get the Project record
       #
-      # If no valid reference is given, returns the `:project` value for the
-      # current context.
+      # Defaults to value of `context[:project]` if:
+      # - No reference is given
+      # - Reference given doesn't exist
+      # - Reference given can't be read by the current user
       #
       # ref - String reference.
       #
       # Returns a Project
       def project_from_ref(ref)
         if ref && other = Project.find_with_namespace(ref)
-          other
+          if user_can_reference_project?(other)
+            other
+          else
+            context[:project]
+          end
         else
           context[:project]
         end
       end
+
+      def user_can_reference_project?(project, user = context[:current_user])
+        user && Ability.abilities.allowed?(user, :read_project, project)
+      end
     end
   end
 end