restrict user result set by the scoped group

1 files changed, 9 insertions, 3 deletions

diff --git a/lib/gitlab/group_search_results.rb b/lib/gitlab/group_search_results.rb
index 8223135dc07..7255293b194 100644
--- a/lib/gitlab/group_search_results.rb
+++ b/lib/gitlab/group_search_results.rb
@@ -13,11 +13,17 @@ module Gitlab
       # 1: get all groups the current user has access to
       groups = GroupsFinder.new(current_user).execute.joins(:users)
 
-      # 2: get all users the current user has access to (-> `SearchResults#users`)
+      # 2: Get the group's whole hierarchy
+      group_users = @group.direct_and_indirect_users
+
+      # 3: get all users the current user has access to (->
+      # `SearchResults#users`), which also applies the query.
       users = super
 
-      # 3: filter for users that belong to the previously selected groups
-      users.where(id: groups.select('members.user_id'))
+      # 4: filter for users that belong to the previously selected groups
+      users
+        .where(id: group_users.select('id'))
+        .where(id: groups.select('members.user_id'))
     end
     # rubocop:enable CodeReuse/ActiveRecord
   end