Merge branch 'dz-restrict-autocomplete' into 'security-9-1'

app/controllers/autocomplete_controller.rb

@@ -21,7 +21,7 @@ class AutocompleteController < ApplicationController
         @users = [current_user, *@users].uniq
       end
 
-      if params[:author_id].present?
+      if params[:author_id].present? && current_user
         author = User.find_by_id(params[:author_id])
         @users = [author, *@users].uniq if author
       end

changelogs/unreleased/dz-restrict-autocomplete.yml

+---
+title: Allow users autocomplete by author_id only for authenticated users
+merge_request:
+author:

spec/controllers/autocomplete_controller_spec.rb

@@ -156,12 +156,13 @@ describe AutocompleteController do
     end
 
     context 'author of issuable included' do
+      let(:body) { JSON.parse(response.body) }
+
+      context 'authenticated' do
         before do
           sign_in(user)
         end
 
-      let(:body) { JSON.parse(response.body) }
-
         it 'includes the author' do
           get(:users, author_id: non_member.id)
 
@@ -175,6 +176,15 @@ describe AutocompleteController do
         end
       end
 
+      context 'without authenticating' do
+        it 'returns empty result' do
+          get(:users, author_id: non_member.id)
+
+          expect(body).to be_empty
+        end
+      end
+    end
+
     context 'skip_users parameter included' do
       before { sign_in(user) }