Merge branch 'confidential-issue-notes' into 'master'

Project members with guest role can't access notes on confidential issues

Related issues:
- https://gitlab.com/gitlab-org/gitlab-ce/issues/18535
- https://gitlab.com/gitlab-org/gitlab-ce/issues/14787

See merge request !1971

spec/finders/notes_finder_spec.rb

@@ -49,6 +49,13 @@ describe NotesFinder do
         user = create(:user)
         expect { NotesFinder.new.execute(project, user, params) }.to raise_error(ActiveRecord::RecordNotFound)
       end
+
+      it 'raises an error for project members with guest role' do
+        user = create(:user)
+        project.team << [user, :guest]
+
+        expect { NotesFinder.new.execute(project, user, params) }.to raise_error(ActiveRecord::RecordNotFound)
+      end
     end
   end
 end