Prevent rendering the link when the author has no access

lib/banzai/filter/user_reference_filter.rb

@@ -106,6 +106,9 @@ module Banzai
         project = context[:project]
         author = context[:author]
 
+        if  author && !project.team.member?(author)
+          '@all'
+        else
           url = urls.namespace_project_url(project.namespace, project,
                                            only_path: context[:only_path])
 
@@ -114,6 +117,7 @@ module Banzai
 
           link_tag(url, data, text, 'All Project and Group Members')
         end
+      end
 
       def link_to_namespace(namespace, link_text: nil)
         if namespace.is_a?(Group)