mention_restrict_to_project_members.patch - Redmine

         q = params[:q].to_s.strip
         scope = nil
         if params[:q].blank? && @project.present?
           scope = @project.principals.assignable_watchers.limit(100)
         if @project.present?
           scope = @project.principals.assignable_watchers
           scope = scope.limit(10) if params[:q].present?
         else
           scope = Principal.assignable_watchers.limit(10)
         end

               new_matches = (current_matches - previous_matches).flatten
               if new_matches.any?
                 self.mentioned_users = User.visible.active.where(login: new_matches)
                 scope = User.visible.active.where(login: new_matches)
                 if respond_to?(:project) && project
                   scope = scope.where(admin: true).or(scope.where(id: project.principals.select(:id)))
                 end
                 self.mentioned_users = scope
               end
             end

         assert_equal ['dlopper', 'jsmith'], response.parsed_body.pluck('login')
       end
       def test_autocomplete_for_mention_with_query_should_not_return_users_outside_the_project
         # "someone" (id: 7) does not belong to any project
         @request.session[:user_id] = 1
         get :autocomplete_for_mention, params: {
           project_id: 'ecookbook',
           object_type: 'issue',
           object_id: '1',
           q: 'someone'
         }, xhr: true
         assert_response :success
         assert_equal [], response.parsed_body.pluck('login')
       end
       def test_autocomplete_for_user_should_not_return_users_without_object_visibility
         @request.session[:user_id] = 1
         get :autocomplete_for_user, :params => {

         assert_equal [User.find(2)], issue.mentioned_users
       end
       def test_mentioned_users_should_not_include_users_outside_the_project
         # "someone" (id: 7) does not belong to any project
         issue = Issue.generate!(project_id: 1, description: '@jsmith @someone')
         assert_equal [User.find(2)], issue.mentioned_users
       end
       def test_mentioned_users_should_not_include_mentioned_users_in_existing_content
         issue = Issue.generate!(project_id: 1, description: 'Hello @dlopper')

Redmine