1 files changed, 27 insertions, 0 deletions
diff --git a/app/models/note.rb b/app/models/note.rb
index 41e45a8759f..986a85acac6 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -111,6 +111,7 @@ class Note < ApplicationRecord
   end
 
   validate :does_not_exceed_notes_limit?, on: :create, unless: [:system?, :importing?]
+  validate :validate_created_after
 
   # @deprecated attachments are handled by the Upload model.
   #
@@ -665,6 +666,25 @@ class Note < ApplicationRecord
     )
   end
 
+  def mentioned_users(current_user = nil)
+    users = super
+
+    return users unless confidential?
+
+    Ability.users_that_can_read_internal_notes(users, resource_parent)
+  end
+
+  def mentioned_filtered_user_ids_for(references)
+    return super unless confidential?
+
+    user_ids = references.mentioned_user_ids.presence
+
+    return [] if user_ids.blank?
+
+    users = User.where(id: user_ids)
+    Ability.users_that_can_read_internal_notes(users, resource_parent).pluck(:id)
+  end
+
   private
 
   def system_note_viewable_by?(user)
@@ -729,6 +749,13 @@ class Note < ApplicationRecord
     errors.add(:base, _('Maximum number of comments exceeded')) if noteable.notes.count >= Noteable::MAX_NOTES_LIMIT
   end
 
+  def validate_created_after
+    return unless created_at
+    return if created_at >= '1970-01-01'
+
+    errors.add(:created_at, s_('Note|The created date provided is too far in the past.'))
+  end
+
   def noteable_label_url_method
     for_merge_request? ? :project_merge_requests_url : :project_issues_url
   end