diff --git a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php --- a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php +++ b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php @@ -1053,13 +1053,30 @@ $phids = array_diff($phids, $this->subscribers); } - foreach ($phids as $key => $phid) { - if ($object->isAutomaticallySubscribed($phid)) { - unset($phids[$key]); + if ($phids) { + $users = id(new PhabricatorPeopleQuery()) + ->withPHIDs($phids) + ->loadPage(); + $users = mpull($users, null, 'getPHID'); + + foreach ($phids as $key => $phid) { + // Do not subscribe mentioned users + // who do not have VIEW Permissions + if (!PhabricatorPolicyFilter::hasCapability( + $users[$phid], + $object, + PhabricatorPolicyCapability::CAN_VIEW) + ) { + unset($phids[$key]); + } else { + if ($object->isAutomaticallySubscribed($phid)) { + unset($phids[$key]); + } + } } + $phids = array_values($phids); } - $phids = array_values($phids); - + // No else here to properly return null should we unset all subscriber if (!$phids) { return null; }