Don't notify users without access to the project when they are (accidentally) mentioned in a note.

1 files changed, 8 insertions, 3 deletions

diff --git a/app/services/notification_service.rb b/app/services/notification_service.rb
index 3735a136365..e294b23bc23 100644
--- a/app/services/notification_service.rb
+++ b/app/services/notification_service.rb
@@ -107,12 +107,17 @@ class NotificationService
 
     recipients = []
 
+    mentioned_users = note.mentioned_users
+    mentioned_users.select! do |user|
+      user.can?(:read_project, note.project)
+    end
+
     # Add all users participating in the thread (author, assignee, comment authors)
     participants = 
       if target.respond_to?(:participants)
         target.participants(note.author)
       else
-        note.mentioned_users
+        mentioned_users
       end
     recipients = recipients.concat(participants)
 
@@ -120,8 +125,8 @@ class NotificationService
     recipients = add_project_watchers(recipients, note.project)
 
     # Reject users with Mention notification level, except those mentioned in _this_ note.
-    recipients = reject_mention_users(recipients - note.mentioned_users, note.project)
-    recipients = recipients + note.mentioned_users
+    recipients = reject_mention_users(recipients - mentioned_users, note.project)
+    recipients = recipients + mentioned_users
 
     recipients = reject_muted_users(recipients, note.project)