Merge branch 'security-epic-notes-api-reveals-historical-info-ce-12-1' into '12-1-stable'

Filter out old system notes for epics in notes api endpoint response

See merge request gitlab/gitlabhq!3310

3 files changed, 10 insertions, 6 deletions

diff --git a/lib/api/discussions.rb b/lib/api/discussions.rb
index cc62ce22a1b..3fb70024201 100644
--- a/lib/api/discussions.rb
+++ b/lib/api/discussions.rb
@@ -32,7 +32,7 @@ module API
             .includes(:noteable)
             .fresh
 
-          notes = notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+          notes = notes.select { |n| n.visible_for?(current_user) }
           discussions = Kaminari.paginate_array(Discussion.build_collection(notes, noteable))
 
           present paginate(discussions), with: Entities::Discussion
@@ -233,7 +233,7 @@ module API
           .includes(:noteable)
           .fresh
 
-        notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+        notes.select { |n| n.visible_for?(current_user) }
       end
       # rubocop: enable CodeReuse/ActiveRecord
     end
diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb
index b03ac7deb71..d1de156376c 100644
--- a/lib/api/helpers/notes_helpers.rb
+++ b/lib/api/helpers/notes_helpers.rb
@@ -10,7 +10,7 @@ module API
       end
 
       def update_note(noteable, note_id)
-        note = noteable.notes.find(params[:note_id])
+        note = noteable.notes.find(note_id)
 
         authorize! :admin_note, note
 
@@ -59,8 +59,8 @@ module API
       end
 
       def get_note(noteable, note_id)
-        note = noteable.notes.with_metadata.find(params[:note_id])
-        can_read_note = !note.cross_reference_not_visible_for?(current_user)
+        note = noteable.notes.with_metadata.find(note_id)
+        can_read_note = note.visible_for?(current_user)
 
         if can_read_note
           present note, with: Entities::Note
@@ -81,6 +81,10 @@ module API
         noteable || not_found!(noteable_type)
       end
 
+      def reject_note?(noteable_type, noteable, parent_type, parent_id, note)
+        note.cross_reference_not_visible_for?(current_user)
+      end
+
       def params_by_noteable_type_and_id(type, id)
         target_type = type.name.underscore
         { target_type: target_type }.tap do |h|
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 9381f045144..eaf97bb119e 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -41,7 +41,7 @@ module API
             # mismatch between the pagination headers info and the actual notes
             # array returned, but this is really a edge-case.
             paginate(raw_notes)
-            .reject { |n| n.cross_reference_not_visible_for?(current_user) }
+            .select { |note| note.visible_for?(current_user) }
           present notes, with: Entities::Note
         end
         # rubocop: enable CodeReuse/ActiveRecord