Reference issues from pull requests and other issues (#8137)

* Update ref comment

* Generate comment on simple ref

* Make fmt + remove unneeded repo load

* Add TODO comments

* Add ref-check in issue creation; re-arrange template

* Make unit tests pass; rearrange code

* Make fmt

* Filter out xref comment if user can't see the referencing issue

* Add TODOs

* Add cross reference

* Rearrange code; add cross-repository references

* Striketrhough obsolete references

* Remove unnecesary TODO

* Add "not supported" note

* Support for edits and deletes, and issue title

* Revert changes to go.mod

* Fix fmt

* Add support for xref from API

* Add first integration test

* Add integration tests

* Correct formatting

* Fix add comment test

* Add migration

* Remove outdated comments; fix typo

* Some code refactoring and rearranging

* Rename findCrossReferences to createCrossReferences

* Delete xrefs when repository is deleted

* Corrections as suggested by @lafriks

* Prepare for merge

* Fix log for errors

10 files changed, 610 insertions, 16 deletions

diff --git a/integrations/issue_test.go b/integrations/issue_test.go
index 10084000db..0b153607ee 100644
--- a/integrations/issue_test.go
+++ b/integrations/issue_test.go
@@ -5,6 +5,7 @@
 package integrations
 
 import (
+	"fmt"
 	"net/http"
 	"path"
 	"strconv"
@@ -136,7 +137,7 @@ func testNewIssue(t *testing.T, session *TestSession, user, repo, title, content
 	return issueURL
 }
 
-func testIssueAddComment(t *testing.T, session *TestSession, issueURL, content, status string) {
+func testIssueAddComment(t *testing.T, session *TestSession, issueURL, content, status string) int64 {
 
 	req := NewRequest(t, "GET", issueURL)
 	resp := session.MakeRequest(t, req, http.StatusOK)
@@ -161,6 +162,13 @@ func testIssueAddComment(t *testing.T, session *TestSession, issueURL, content,
 
 	val := htmlDoc.doc.Find(".comment-list .comments .comment .render-content p").Eq(commentCount).Text()
 	assert.Equal(t, content, val)
+
+	idAttr, has := htmlDoc.doc.Find(".comment-list .comments .comment").Eq(commentCount).Attr("id")
+	idStr := idAttr[strings.LastIndexByte(idAttr, '-')+1:]
+	assert.True(t, has)
+	id, err := strconv.Atoi(idStr)
+	assert.NoError(t, err)
+	return int64(id)
 }
 
 func TestNewIssue(t *testing.T) {
@@ -184,3 +192,97 @@ func TestIssueCommentClose(t *testing.T) {
 	val := htmlDoc.doc.Find(".comment-list .comments .comment .render-content p").First().Text()
 	assert.Equal(t, "Description", val)
 }
+
+func TestIssueCrossReference(t *testing.T) {
+	prepareTestEnv(t)
+
+	// Issue that will be referenced
+	_, issueBase := testIssueWithBean(t, "user2", 1, "Title", "Description")
+
+	// Ref from issue title
+	issueRefURL, issueRef := testIssueWithBean(t, "user2", 1, fmt.Sprintf("Title ref #%d", issueBase.Index), "Description")
+	models.AssertExistsAndLoadBean(t, &models.Comment{
+		IssueID:      issueBase.ID,
+		RefRepoID:    1,
+		RefIssueID:   issueRef.ID,
+		RefCommentID: 0,
+		RefIsPull:    false,
+		RefAction:    models.XRefActionNone})
+
+	// Edit title, neuter ref
+	testIssueChangeInfo(t, "user2", issueRefURL, "title", "Title no ref")
+	models.AssertExistsAndLoadBean(t, &models.Comment{
+		IssueID:      issueBase.ID,
+		RefRepoID:    1,
+		RefIssueID:   issueRef.ID,
+		RefCommentID: 0,
+		RefIsPull:    false,
+		RefAction:    models.XRefActionNeutered})
+
+	// Ref from issue content
+	issueRefURL, issueRef = testIssueWithBean(t, "user2", 1, "TitleXRef", fmt.Sprintf("Description ref #%d", issueBase.Index))
+	models.AssertExistsAndLoadBean(t, &models.Comment{
+		IssueID:      issueBase.ID,
+		RefRepoID:    1,
+		RefIssueID:   issueRef.ID,
+		RefCommentID: 0,
+		RefIsPull:    false,
+		RefAction:    models.XRefActionNone})
+
+	// Edit content, neuter ref
+	testIssueChangeInfo(t, "user2", issueRefURL, "content", "Description no ref")
+	models.AssertExistsAndLoadBean(t, &models.Comment{
+		IssueID:      issueBase.ID,
+		RefRepoID:    1,
+		RefIssueID:   issueRef.ID,
+		RefCommentID: 0,
+		RefIsPull:    false,
+		RefAction:    models.XRefActionNeutered})
+
+	// Ref from a comment
+	session := loginUser(t, "user2")
+	commentID := testIssueAddComment(t, session, issueRefURL, fmt.Sprintf("Adding ref from comment #%d", issueBase.Index), "")
+	comment := &models.Comment{
+		IssueID:      issueBase.ID,
+		RefRepoID:    1,
+		RefIssueID:   issueRef.ID,
+		RefCommentID: commentID,
+		RefIsPull:    false,
+		RefAction:    models.XRefActionNone}
+	models.AssertExistsAndLoadBean(t, comment)
+
+	// Ref from a different repository
+	issueRefURL, issueRef = testIssueWithBean(t, "user12", 10, "TitleXRef", fmt.Sprintf("Description ref user2/repo1#%d", issueBase.Index))
+	models.AssertExistsAndLoadBean(t, &models.Comment{
+		IssueID:      issueBase.ID,
+		RefRepoID:    10,
+		RefIssueID:   issueRef.ID,
+		RefCommentID: 0,
+		RefIsPull:    false,
+		RefAction:    models.XRefActionNone})
+}
+
+func testIssueWithBean(t *testing.T, user string, repoID int64, title, content string) (string, *models.Issue) {
+	session := loginUser(t, user)
+	issueURL := testNewIssue(t, session, user, fmt.Sprintf("repo%d", repoID), title, content)
+	indexStr := issueURL[strings.LastIndexByte(issueURL, '/')+1:]
+	index, err := strconv.Atoi(indexStr)
+	assert.NoError(t, err, "Invalid issue href: %s", issueURL)
+	issue := &models.Issue{RepoID: repoID, Index: int64(index)}
+	models.AssertExistsAndLoadBean(t, issue)
+	return issueURL, issue
+}
+
+func testIssueChangeInfo(t *testing.T, user, issueURL, info string, value string) {
+	session := loginUser(t, user)
+
+	req := NewRequest(t, "GET", issueURL)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+	htmlDoc := NewHTMLParser(t, resp.Body)
+
+	req = NewRequestWithValues(t, "POST", path.Join(issueURL, info), map[string]string{
+		"_csrf": htmlDoc.GetCSRF(),
+		info:    value,
+	})
+	_ = session.MakeRequest(t, req, http.StatusOK)
+}
diff --git a/models/issue.go b/models/issue.go
index 87e64ce99b..bb2db94407 100644
--- a/models/issue.go
+++ b/models/issue.go
@@ -595,8 +595,9 @@ func (issue *Issue) ClearLabels(doer *User) (err error) {
 	if err = sess.Commit(); err != nil {
 		return fmt.Errorf("Commit: %v", err)
 	}
+	sess.Close()
 
-	if err = issue.loadPoster(x); err != nil {
+	if err = issue.LoadPoster(); err != nil {
 		return fmt.Errorf("loadPoster: %v", err)
 	}
 
@@ -870,9 +871,18 @@ func (issue *Issue) ChangeTitle(doer *User, title string) (err error) {
 		return fmt.Errorf("createChangeTitleComment: %v", err)
 	}
 
+	if err = issue.neuterCrossReferences(sess); err != nil {
+		return err
+	}
+
+	if err = issue.addCrossReferences(sess, doer); err != nil {
+		return err
+	}
+
 	if err = sess.Commit(); err != nil {
 		return err
 	}
+	sess.Close()
 
 	mode, _ := AccessLevel(issue.Poster, issue.Repo)
 	if issue.IsPull {
@@ -939,9 +949,26 @@ func (issue *Issue) ChangeContent(doer *User, content string) (err error) {
 	oldContent := issue.Content
 	issue.Content = content
 
-	if err = UpdateIssueCols(issue, "content"); err != nil {
+	sess := x.NewSession()
+	defer sess.Close()
+	if err = sess.Begin(); err != nil {
+		return err
+	}
+
+	if err = updateIssueCols(sess, issue, "content"); err != nil {
 		return fmt.Errorf("UpdateIssueCols: %v", err)
 	}
+	if err = issue.neuterCrossReferences(sess); err != nil {
+		return err
+	}
+	if err = issue.addCrossReferences(sess, doer); err != nil {
+		return err
+	}
+
+	if err = sess.Commit(); err != nil {
+		return err
+	}
+	sess.Close()
 
 	mode, _ := AccessLevel(issue.Poster, issue.Repo)
 	if issue.IsPull {
@@ -1171,8 +1198,10 @@ func newIssue(e *xorm.Session, doer *User, opts NewIssueOptions) (err error) {
 			}
 		}
 	}
-
-	return opts.Issue.loadAttributes(e)
+	if err = opts.Issue.loadAttributes(e); err != nil {
+		return err
+	}
+	return opts.Issue.addCrossReferences(e, doer)
 }
 
 // NewIssue creates new issue with labels for repository.
@@ -1199,6 +1228,7 @@ func NewIssue(repo *Repository, issue *Issue, labelIDs []int64, assigneeIDs []in
 	if err = sess.Commit(); err != nil {
 		return fmt.Errorf("Commit: %v", err)
 	}
+	sess.Close()
 
 	if err = NotifyWatchers(&Action{
 		ActUserID: issue.Poster.ID,
@@ -1808,7 +1838,24 @@ func updateIssue(e Engine, issue *Issue) error {
 
 // UpdateIssue updates all fields of given issue.
 func UpdateIssue(issue *Issue) error {
-	return updateIssue(x, issue)
+	sess := x.NewSession()
+	defer sess.Close()
+	if err := sess.Begin(); err != nil {
+		return err
+	}
+	if err := updateIssue(sess, issue); err != nil {
+		return err
+	}
+	if err := issue.neuterCrossReferences(sess); err != nil {
+		return err
+	}
+	if err := issue.loadPoster(sess); err != nil {
+		return err
+	}
+	if err := issue.addCrossReferences(sess, issue.Poster); err != nil {
+		return err
+	}
+	return sess.Commit()
 }
 
 // UpdateIssueDeadline updates an issue deadline and adds comments. Setting a deadline to 0 means deleting it.
diff --git a/models/issue_comment.go b/models/issue_comment.go
index 2a9e8596cb..0bb313c30b 100644
--- a/models/issue_comment.go
+++ b/models/issue_comment.go
@@ -142,14 +142,30 @@ type Comment struct {
 	Review      *Review `xorm:"-"`
 	ReviewID    int64   `xorm:"index"`
 	Invalidated bool
+
+	// Reference an issue or pull from another comment, issue or PR
+	// All information is about the origin of the reference
+	RefRepoID    int64      `xorm:"index"` // Repo where the referencing
+	RefIssueID   int64      `xorm:"index"`
+	RefCommentID int64      `xorm:"index"`    // 0 if origin is Issue title or content (or PR's)
+	RefAction    XRefAction `xorm:"SMALLINT"` // What hapens if RefIssueID resolves
+	RefIsPull    bool
+
+	RefRepo    *Repository `xorm:"-"`
+	RefIssue   *Issue      `xorm:"-"`
+	RefComment *Comment    `xorm:"-"`
 }
 
 // LoadIssue loads issue from database
 func (c *Comment) LoadIssue() (err error) {
+	return c.loadIssue(x)
+}
+
+func (c *Comment) loadIssue(e Engine) (err error) {
 	if c.Issue != nil {
 		return nil
 	}
-	c.Issue, err = GetIssueByID(c.IssueID)
+	c.Issue, err = getIssueByID(e, c.IssueID)
 	return
 }
 
@@ -527,6 +543,11 @@ func createComment(e *xorm.Session, opts *CreateCommentOptions) (_ *Comment, err
 		TreePath:         opts.TreePath,
 		ReviewID:         opts.ReviewID,
 		Patch:            opts.Patch,
+		RefRepoID:        opts.RefRepoID,
+		RefIssueID:       opts.RefIssueID,
+		RefCommentID:     opts.RefCommentID,
+		RefAction:        opts.RefAction,
+		RefIsPull:        opts.RefIsPull,
 	}
 	if _, err = e.Insert(comment); err != nil {
 		return nil, err
@@ -540,6 +561,10 @@ func createComment(e *xorm.Session, opts *CreateCommentOptions) (_ *Comment, err
 		return nil, err
 	}
 
+	if err = comment.addCrossReferences(e, opts.Doer); err != nil {
+		return nil, err
+	}
+
 	return comment, nil
 }
 
@@ -794,6 +819,11 @@ type CreateCommentOptions struct {
 	ReviewID         int64
 	Content          string
 	Attachments      []string // UUIDs of attachments
+	RefRepoID        int64
+	RefIssueID       int64
+	RefCommentID     int64
+	RefAction        XRefAction
+	RefIsPull        bool
 }
 
 // CreateComment creates comment of issue or commit.
@@ -934,21 +964,33 @@ func FindComments(opts FindCommentsOptions) ([]*Comment, error) {
 
 // UpdateComment updates information of comment.
 func UpdateComment(doer *User, c *Comment, oldContent string) error {
-	if _, err := x.ID(c.ID).AllCols().Update(c); err != nil {
+	sess := x.NewSession()
+	defer sess.Close()
+	if err := sess.Begin(); err != nil {
 		return err
 	}
 
-	if err := c.LoadPoster(); err != nil {
+	if _, err := sess.ID(c.ID).AllCols().Update(c); err != nil {
 		return err
 	}
-	if err := c.LoadIssue(); err != nil {
+	if err := c.loadIssue(sess); err != nil {
 		return err
 	}
+	if err := c.neuterCrossReferences(sess); err != nil {
+		return err
+	}
+	if err := c.addCrossReferences(sess, doer); err != nil {
+		return err
+	}
+	if err := sess.Commit(); err != nil {
+		return fmt.Errorf("Commit: %v", err)
+	}
+	sess.Close()
 
-	if err := c.Issue.LoadAttributes(); err != nil {
+	if err := c.LoadPoster(); err != nil {
 		return err
 	}
-	if err := c.loadPoster(x); err != nil {
+	if err := c.Issue.LoadAttributes(); err != nil {
 		return err
 	}
 
@@ -996,6 +1038,10 @@ func DeleteComment(doer *User, comment *Comment) error {
 		return err
 	}
 
+	if err := comment.neuterCrossReferences(sess); err != nil {
+		return err
+	}
+
 	if err := sess.Commit(); err != nil {
 		return err
 	}
@@ -1014,6 +1060,9 @@ func DeleteComment(doer *User, comment *Comment) error {
 	if err := comment.loadPoster(x); err != nil {
 		return err
 	}
+	if err := comment.neuterCrossReferences(x); err != nil {
+		return err
+	}
 
 	mode, _ := AccessLevel(doer, comment.Issue.Repo)
 
diff --git a/models/issue_xref.go b/models/issue_xref.go
new file mode 100644
index 0000000000..3631bf3246
--- /dev/null
+++ b/models/issue_xref.go
@@ -0,0 +1,308 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package models
+
+import (
+	"regexp"
+	"strconv"
+
+	"code.gitea.io/gitea/modules/log"
+
+	"github.com/go-xorm/xorm"
+	"github.com/unknwon/com"
+)
+
+var (
+	// TODO: Unify all regexp treatment of cross references in one place
+
+	// issueNumericPattern matches string that references to a numeric issue, e.g. #1287
+	issueNumericPattern = regexp.MustCompile(`(?:\s|^|\(|\[)(?:#)([0-9]+)(?:\s|$|\)|\]|:|\.(\s|$))`)
+	// crossReferenceIssueNumericPattern matches string that references a numeric issue in a different repository
+	// e.g. gogits/gogs#12345
+	crossReferenceIssueNumericPattern = regexp.MustCompile(`(?:\s|^|\(|\[)([0-9a-zA-Z-_\.]+)/([0-9a-zA-Z-_\.]+)#([0-9]+)(?:\s|$|\)|\]|\.(\s|$))`)
+)
+
+// XRefAction represents the kind of effect a cross reference has once is resolved
+type XRefAction int64
+
+const (
+	// XRefActionNone means the cross-reference is a mention (commit, etc.)
+	XRefActionNone XRefAction = iota // 0
+	// XRefActionCloses means the cross-reference should close an issue if it is resolved
+	XRefActionCloses // 1 - not implemented yet
+	// XRefActionReopens means the cross-reference should reopen an issue if it is resolved
+	XRefActionReopens // 2 - Not implemented yet
+	// XRefActionNeutered means the cross-reference will no longer affect the source
+	XRefActionNeutered // 3
+)
+
+type crossReference struct {
+	Issue  *Issue
+	Action XRefAction
+}
+
+// crossReferencesContext is context to pass along findCrossReference functions
+type crossReferencesContext struct {
+	Type        CommentType
+	Doer        *User
+	OrigIssue   *Issue
+	OrigComment *Comment
+}
+
+func newCrossReference(e *xorm.Session, ctx *crossReferencesContext, xref *crossReference) error {
+	var refCommentID int64
+	if ctx.OrigComment != nil {
+		refCommentID = ctx.OrigComment.ID
+	}
+	_, err := createComment(e, &CreateCommentOptions{
+		Type:         ctx.Type,
+		Doer:         ctx.Doer,
+		Repo:         xref.Issue.Repo,
+		Issue:        xref.Issue,
+		RefRepoID:    ctx.OrigIssue.RepoID,
+		RefIssueID:   ctx.OrigIssue.ID,
+		RefCommentID: refCommentID,
+		RefAction:    xref.Action,
+		RefIsPull:    xref.Issue.IsPull,
+	})
+	return err
+}
+
+func neuterCrossReferences(e Engine, issueID int64, commentID int64) error {
+	active := make([]*Comment, 0, 10)
+	sess := e.Where("`ref_action` IN (?, ?, ?)", XRefActionNone, XRefActionCloses, XRefActionReopens)
+	if issueID != 0 {
+		sess = sess.And("`ref_issue_id` = ?", issueID)
+	}
+	if commentID != 0 {
+		sess = sess.And("`ref_comment_id` = ?", commentID)
+	}
+	if err := sess.Find(&active); err != nil || len(active) == 0 {
+		return err
+	}
+	ids := make([]int64, len(active))
+	for i, c := range active {
+		ids[i] = c.ID
+	}
+	_, err := e.In("id", ids).Cols("`ref_action`").Update(&Comment{RefAction: XRefActionNeutered})
+	return err
+}
+
+// .___
+// |   | ______ ________ __   ____
+// |   |/  ___//  ___/  |  \_/ __ \
+// |   |\___ \ \___ \|  |  /\  ___/
+// |___/____  >____  >____/  \___  >
+//          \/     \/            \/
+//
+
+func (issue *Issue) addCrossReferences(e *xorm.Session, doer *User) error {
+	var commentType CommentType
+	if issue.IsPull {
+		commentType = CommentTypePullRef
+	} else {
+		commentType = CommentTypeIssueRef
+	}
+	ctx := &crossReferencesContext{
+		Type:      commentType,
+		Doer:      doer,
+		OrigIssue: issue,
+	}
+	return issue.createCrossReferences(e, ctx, issue.Title+"\n"+issue.Content)
+}
+
+func (issue *Issue) createCrossReferences(e *xorm.Session, ctx *crossReferencesContext, content string) error {
+	xreflist, err := ctx.OrigIssue.getCrossReferences(e, ctx, content)
+	if err != nil {
+		return err
+	}
+	for _, xref := range xreflist {
+		if err = newCrossReference(e, ctx, xref); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (issue *Issue) getCrossReferences(e *xorm.Session, ctx *crossReferencesContext, content string) ([]*crossReference, error) {
+	xreflist := make([]*crossReference, 0, 5)
+	var xref *crossReference
+
+	// Issues in the same repository
+	// FIXME: Should we support IssueNameStyleAlphanumeric?
+	matches := issueNumericPattern.FindAllStringSubmatch(content, -1)
+	for _, match := range matches {
+		if index, err := strconv.ParseInt(match[1], 10, 64); err == nil {
+			if err = ctx.OrigIssue.loadRepo(e); err != nil {
+				return nil, err
+			}
+			if xref, err = ctx.OrigIssue.isValidCommentReference(e, ctx, issue.Repo, index); err != nil {
+				return nil, err
+			}
+			if xref != nil {
+				xreflist = ctx.OrigIssue.updateCrossReferenceList(xreflist, xref)
+			}
+		}
+	}
+
+	// Issues in other repositories
+	matches = crossReferenceIssueNumericPattern.FindAllStringSubmatch(content, -1)
+	for _, match := range matches {
+		if index, err := strconv.ParseInt(match[3], 10, 64); err == nil {
+			repo, err := getRepositoryByOwnerAndName(e, match[1], match[2])
+			if err != nil {
+				if IsErrRepoNotExist(err) {
+					continue
+				}
+				return nil, err
+			}
+			if err = ctx.OrigIssue.loadRepo(e); err != nil {
+				return nil, err
+			}
+			if xref, err = issue.isValidCommentReference(e, ctx, repo, index); err != nil {
+				return nil, err
+			}
+			if xref != nil {
+				xreflist = issue.updateCrossReferenceList(xreflist, xref)
+			}
+		}
+	}
+
+	return xreflist, nil
+}
+
+func (issue *Issue) updateCrossReferenceList(list []*crossReference, xref *crossReference) []*crossReference {
+	if xref.Issue.ID == issue.ID {
+		return list
+	}
+	for i, r := range list {
+		if r.Issue.ID == xref.Issue.ID {
+			if xref.Action != XRefActionNone {
+				list[i].Action = xref.Action
+			}
+			return list
+		}
+	}
+	return append(list, xref)
+}
+
+func (issue *Issue) isValidCommentReference(e Engine, ctx *crossReferencesContext, repo *Repository, index int64) (*crossReference, error) {
+	refIssue := &Issue{RepoID: repo.ID, Index: index}
+	if has, _ := e.Get(refIssue); !has {
+		return nil, nil
+	}
+	if err := refIssue.loadRepo(e); err != nil {
+		return nil, err
+	}
+	// Check user permissions
+	if refIssue.Repo.ID != ctx.OrigIssue.Repo.ID {
+		perm, err := getUserRepoPermission(e, refIssue.Repo, ctx.Doer)
+		if err != nil {
+			return nil, err
+		}
+		if !perm.CanReadIssuesOrPulls(refIssue.IsPull) {
+			return nil, nil
+		}
+	}
+	return &crossReference{
+		Issue:  refIssue,
+		Action: XRefActionNone,
+	}, nil
+}
+
+func (issue *Issue) neuterCrossReferences(e Engine) error {
+	return neuterCrossReferences(e, issue.ID, 0)
+}
+
+// _________                                       __
+// \_   ___ \  ____   _____   _____   ____   _____/  |_
+// /    \  \/ /  _ \ /     \ /     \_/ __ \ /    \   __\
+// \     \___(  <_> )  Y Y  \  Y Y  \  ___/|   |  \  |
+//  \______  /\____/|__|_|  /__|_|  /\___  >___|  /__|
+//         \/             \/      \/     \/     \/
+//
+
+func (comment *Comment) addCrossReferences(e *xorm.Session, doer *User) error {
+	if comment.Type != CommentTypeCode && comment.Type != CommentTypeComment {
+		return nil
+	}
+	if err := comment.loadIssue(e); err != nil {
+		return err
+	}
+	ctx := &crossReferencesContext{
+		Type:        CommentTypeCommentRef,
+		Doer:        doer,
+		OrigIssue:   comment.Issue,
+		OrigComment: comment,
+	}
+	return comment.Issue.createCrossReferences(e, ctx, comment.Content)
+}
+
+func (comment *Comment) neuterCrossReferences(e Engine) error {
+	return neuterCrossReferences(e, 0, comment.ID)
+}
+
+// LoadRefComment loads comment that created this reference from database
+func (comment *Comment) LoadRefComment() (err error) {
+	if comment.RefComment != nil {
+		return nil
+	}
+	comment.RefComment, err = GetCommentByID(comment.RefCommentID)
+	return
+}
+
+// LoadRefIssue loads comment that created this reference from database
+func (comment *Comment) LoadRefIssue() (err error) {
+	if comment.RefIssue != nil {
+		return nil
+	}
+	comment.RefIssue, err = GetIssueByID(comment.RefIssueID)
+	if err == nil {
+		err = comment.RefIssue.loadRepo(x)
+	}
+	return
+}
+
+// CommentTypeIsRef returns true if CommentType is a reference from another issue
+func CommentTypeIsRef(t CommentType) bool {
+	return t == CommentTypeCommentRef || t == CommentTypePullRef || t == CommentTypeIssueRef
+}
+
+// RefCommentHTMLURL returns the HTML URL for the comment that created this reference
+func (comment *Comment) RefCommentHTMLURL() string {
+	if err := comment.LoadRefComment(); err != nil { // Silently dropping errors :unamused:
+		log.Error("LoadRefComment(%d): %v", comment.RefCommentID, err)
+		return ""
+	}
+	return comment.RefComment.HTMLURL()
+}
+
+// RefIssueHTMLURL returns the HTML URL of the issue where this reference was created
+func (comment *Comment) RefIssueHTMLURL() string {
+	if err := comment.LoadRefIssue(); err != nil { // Silently dropping errors :unamused:
+		log.Error("LoadRefIssue(%d): %v", comment.RefCommentID, err)
+		return ""
+	}
+	return comment.RefIssue.HTMLURL()
+}
+
+// RefIssueTitle returns the title of the issue where this reference was created
+func (comment *Comment) RefIssueTitle() string {
+	if err := comment.LoadRefIssue(); err != nil { // Silently dropping errors :unamused:
+		log.Error("LoadRefIssue(%d): %v", comment.RefCommentID, err)
+		return ""
+	}
+	return comment.RefIssue.Title
+}
+
+// RefIssueIdent returns the user friendly identity (e.g. "#1234") of the issue where this reference was created
+func (comment *Comment) RefIssueIdent() string {
+	if err := comment.LoadRefIssue(); err != nil { // Silently dropping errors :unamused:
+		log.Error("LoadRefIssue(%d): %v", comment.RefCommentID, err)
+		return ""
+	}
+	// FIXME: check this name for cross-repository references (#7901 if it gets merged)
+	return "#" + com.ToStr(comment.RefIssue.Index)
+}
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
index 885043dce5..7c5277fbbd 100644
--- a/models/migrations/migrations.go
+++ b/models/migrations/migrations.go
@@ -244,6 +244,8 @@ var migrations = []Migration{
 	NewMigration("add email notification enabled preference to user", addEmailNotificationEnabledToUser),
 	// v94 -> v95
 	NewMigration("add enable_status_check, status_check_contexts to protected_branch", addStatusCheckColumnsForProtectedBranches),
+	// v95 -> v96
+	NewMigration("add table columns for cross referencing issues", addCrossReferenceColumns),
 }
 
 // Migrate database to current version
diff --git a/models/migrations/v95.go b/models/migrations/v95.go
new file mode 100644
index 0000000000..f6e4e41c48
--- /dev/null
+++ b/models/migrations/v95.go
@@ -0,0 +1,20 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package migrations
+
+import "github.com/go-xorm/xorm"
+
+func addCrossReferenceColumns(x *xorm.Engine) error {
+	// Comment see models/comment.go
+	type Comment struct {
+		RefRepoID    int64 `xorm:"index"`
+		RefIssueID   int64 `xorm:"index"`
+		RefCommentID int64 `xorm:"index"`
+		RefAction    int64 `xorm:"SMALLINT"`
+		RefIsPull    bool
+	}
+
+	return x.Sync2(new(Comment))
+}
diff --git a/models/repo.go b/models/repo.go
index 3e593ce4ed..ffd1c30606 100644
--- a/models/repo.go
+++ b/models/repo.go
@@ -1810,6 +1810,7 @@ func DeleteRepository(doer *User, uid, repoID int64) error {
 		&Notification{RepoID: repoID},
 		&CommitStatus{RepoID: repoID},
 		&RepoIndexerStatus{RepoID: repoID},
+		&Comment{RefRepoID: repoID},
 	); err != nil {
 		return fmt.Errorf("deleteBeans: %v", err)
 	}
@@ -1956,8 +1957,12 @@ func DeleteRepository(doer *User, uid, repoID int64) error {
 
 // GetRepositoryByOwnerAndName returns the repository by given ownername and reponame.
 func GetRepositoryByOwnerAndName(ownerName, repoName string) (*Repository, error) {
+	return getRepositoryByOwnerAndName(x, ownerName, repoName)
+}
+
+func getRepositoryByOwnerAndName(e Engine, ownerName, repoName string) (*Repository, error) {
 	var repo Repository
-	has, err := x.Select("repository.*").
+	has, err := e.Table("repository").Select("repository.*").
 		Join("INNER", "`user`", "`user`.id = repository.owner_id").
 		Where("repository.lower_name = ?", strings.ToLower(repoName)).
 		And("`user`.lower_name = ?", strings.ToLower(ownerName)).
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 843252dc34..52ccea68b2 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -836,6 +836,10 @@ issues.create_comment = Comment
 issues.closed_at = `closed <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.reopened_at = `reopened <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.commit_ref_at = `referenced this issue from a commit <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+issues.ref_issue_at = `referenced this issue %[1]s`
+issues.ref_pull_at = `referenced this pull request %[1]s`
+issues.ref_issue_ext_at = `referenced this issue from %[1]s %[2]s`
+issues.ref_pull_ext_at = `referenced this pull request from %[1]s %[2]s`
 issues.poster = Poster
 issues.collaborator = Collaborator
 issues.owner = Owner
diff --git a/routers/repo/issue.go b/routers/repo/issue.go
index 4ae791221c..b9083e20e9 100644
--- a/routers/repo/issue.go
+++ b/routers/repo/issue.go
@@ -643,9 +643,13 @@ func ViewIssue(ctx *context.Context) {
 	ctx.Data["RequireTribute"] = true
 	renderAttachmentSettings(ctx)
 
-	err = issue.LoadAttributes()
-	if err != nil {
-		ctx.ServerError("GetIssueByIndex", err)
+	if err = issue.LoadAttributes(); err != nil {
+		ctx.ServerError("LoadAttributes", err)
+		return
+	}
+
+	if err = filterXRefComments(ctx, issue); err != nil {
+		ctx.ServerError("filterXRefComments", err)
 		return
 	}
 
@@ -1572,3 +1576,28 @@ func addParticipant(poster *models.User, participants []*models.User) []*models.
 	}
 	return append(participants, poster)
 }
+
+func filterXRefComments(ctx *context.Context, issue *models.Issue) error {
+	// Remove comments that the user has no permissions to see
+	for i := 0; i < len(issue.Comments); {
+		c := issue.Comments[i]
+		if models.CommentTypeIsRef(c.Type) && c.RefRepoID != issue.RepoID && c.RefRepoID != 0 {
+			var err error
+			// Set RefRepo for description in template
+			c.RefRepo, err = models.GetRepositoryByID(c.RefRepoID)
+			if err != nil {
+				return err
+			}
+			perm, err := models.GetUserRepoPermission(c.RefRepo, ctx.User)
+			if err != nil {
+				return err
+			}
+			if !perm.CanReadIssuesOrPulls(c.RefIsPull) {
+				issue.Comments = append(issue.Comments[:i], issue.Comments[i+1:]...)
+				continue
+			}
+		}
+		i++
+	}
+	return nil
+}
diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl
index 70de314c91..a5f25954c7 100644
--- a/templates/repo/issue/view_content/comments.tmpl
+++ b/templates/repo/issue/view_content/comments.tmpl
@@ -96,6 +96,34 @@
 			</a>
 			<span class="text grey"><a href="{{.Poster.HomeLink}}">{{.Poster.GetDisplayName}}</a> {{$.i18n.Tr "repo.issues.closed_at" .EventTag $createdStr | Safe}}</span>
 		</div>
+	{{else if or (eq .Type 3) (eq .Type 5) (eq .Type 6)}}
+		<div class="event">
+			<span class="octicon octicon-bookmark"></span>
+			<a class="ui avatar image" href="{{.Poster.HomeLink}}">
+				<img src="{{.Poster.RelAvatarLink}}">
+			</a>
+			{{if eq .RefAction 3}}<del>{{end}}
+			<span class="text grey"><a href="{{.Poster.HomeLink}}">{{.Poster.GetDisplayName}}</a>
+			{{if (eq .RefRepoID .Issue.RepoID)}}
+				{{if .Issue.IsPull}}
+					<a href="{{.RefCommentHTMLURL}}">{{$.i18n.Tr "repo.issues.ref_pull_at" $createdStr | Safe}}</a>
+				{{else}}
+					<a href="{{.RefCommentHTMLURL}}">{{$.i18n.Tr "repo.issues.ref_issue_at" $createdStr | Safe}}</a>
+				{{end}}
+			{{else}}
+				{{if .Issue.IsPull}}
+					<a href="{{.RefCommentHTMLURL}}">{{$.i18n.Tr "repo.issues.ref_pull_ext_at" .RefRepo.FullName $createdStr | Safe}}</a>
+				{{else}}
+					<a href="{{.RefCommentHTMLURL}}">{{$.i18n.Tr "repo.issues.ref_issue_ext_at" .RefRepo.FullName $createdStr | Safe}}</a>
+				{{end}}
+			{{end}}
+			</span>
+			{{if eq .RefAction 3}}</del>{{end}}
+
+			<div class="detail">
+				<span class="text grey"><a href="{{.RefIssueHTMLURL}}"><b>{{.RefIssueTitle | Str2html}}</b> {{.RefIssueIdent | Str2html}}</a></span>
+			</div>
+		</div>
 	{{else if eq .Type 4}}
 		<div class="event">
 			<span class="octicon octicon-bookmark"></span>