Merge branch 'reference-access-control' into 'master'

Only allow users to reference groups, projects, issues, MRs, commits they have access to.

Addresses https://dev.gitlab.org/gitlab/gitlabhq/issues/2183.

See merge request !1742

1 files changed, 10 insertions, 2 deletions

diff --git a/app/models/commit.rb b/app/models/commit.rb
index e0461809e10..7a0ad137650 100644
--- a/app/models/commit.rb
+++ b/app/models/commit.rb
@@ -117,8 +117,8 @@ class Commit
 
   # Discover issues should be closed when this commit is pushed to a project's
   # default branch.
-  def closes_issues(project)
-    Gitlab::ClosingIssueExtractor.closed_by_message_in_project(safe_message, project)
+  def closes_issues(project, current_user = self.committer)
+    Gitlab::ClosingIssueExtractor.new(project, current_user).closed_by_message(safe_message)
   end
 
   # Mentionable override.
@@ -126,6 +126,14 @@ class Commit
     "commit #{id}"
   end
 
+  def author
+    User.find_for_commit(author_email, author_name)
+  end
+
+  def committer
+    User.find_for_commit(committer_email, committer_name)
+  end
+
   def method_missing(m, *args, &block)
     @raw.send(m, *args, &block)
   end