Details
-
Bug
-
Resolution: Invalid
-
Medium
Description
Current behaviour / steps to reproduce:
Take the following setup into consideration:
- users: john@lorem.com and alice@ipsum.com
- group: lorem-contributors
- project: builder
- repo: web
User alice@ipsum.com is not part of any group / doesn't have access to any project / any repo / any group (except stash-users for login access).
User john@lorem.com is a member of group lorem-contributors
Group lorem-contributors has PROJECT_WRITE access to project builder (so they can create Pull Requests).
When user john@lorem.com creates a PR, he can mention @al in the PR's description field and user alice@ipsum.com will be displayed, even if she doesn't have any access to the project / repo / group.
Expected behaviour:
When mentioning users in the Pull Request description field, only users that have access to that repo / project should be displayed as autocomplete suggestions.