Merge branch 'fix-guest-access-posting-to-notes' into 'security'

changelogs/unreleased/fix-guest-access-posting-to-notes.yml

+---
+title: Prevent users from creating notes on resources they can't access
+merge_request:
+author:

lib/api/notes.rb

@@ -75,6 +75,9 @@ module API
             noteable_id: params[:noteable_id]
           }
 
+          noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id])
+
+          if can?(current_user, noteable_read_ability_name(noteable), noteable)
             if params[:created_at] && (current_user.is_admin? || user_project.owner == current_user)
               opts[:created_at] = params[:created_at]
             end
@@ -86,6 +89,9 @@ module API
             else
               not_found!("Note #{note.errors.messages}")
             end
+          else
+            not_found!("Note")
+          end
         end
 
         desc 'Update an existing +noteable+ note' do

spec/requests/api/notes_spec.rb

@@ -264,6 +264,18 @@ describe API::Notes, api: true  do
       end
     end
 
+    context 'when user does not have access to read the noteable' do
+      it 'responds with 404' do
+        project = create(:empty_project, :private) { |p| p.add_guest(user) }
+        issue = create(:issue, :confidential, project: project)
+
+        post api("/projects/#{project.id}/issues/#{issue.id}/notes", user),
+          body: 'Foo'
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
     context 'when user does not have access to create noteable' do
       let(:private_issue) { create(:issue, project: create(:project, :private)) }