Security: Fix issue auto closing

app/services/git_push_service.rb

@@ -96,9 +96,11 @@ class GitPushService < BaseService
         # a different branch.
         closed_issues = commit.closes_issues(current_user)
         closed_issues.each do |issue|
+          if can?(current_user, :update_issue, issue)
             Issues::CloseService.new(project, authors[commit], {}).execute(issue, commit)
           end
         end
+      end
 
       commit.create_cross_references!(authors[commit], closed_issues)
     end

app/services/merge_requests/post_merge_service.rb

@@ -21,9 +21,11 @@ module MergeRequests
 
       closed_issues = merge_request.closes_issues(current_user)
       closed_issues.each do |issue|
+        if can?(current_user, :update_issue, issue)
           Issues::CloseService.new(project, current_user, {}).execute(issue, merge_request)
         end
       end
+    end
 
     def create_merge_event(merge_request, current_user)
       EventCreateService.new.merge_mr(merge_request, current_user)