Fix Project update service

When project is updated and it is a fork, then visibility_level
should not be less restrictive than in its parent project.

app/models/project.rb

@@ -786,6 +786,6 @@ class Project < ActiveRecord::Base
   def visibility_level_allowed?(level)
     return true unless forked?
-    Gitlab::VisibilityLevel.allowed_fork_levels(forked_from_project.visibility_level).include?(level)
+    Gitlab::VisibilityLevel.allowed_fork_levels(forked_from_project.visibility_level).include?(level.to_i)
   end
 end

app/services/projects/update_service.rb

@@ -11,6 +11,15 @@ module Projects
         end
       end
+      unless project.visibility_level_allowed?(new_visibility)
+        level_name = Gitlab::VisibilityLevel.level_name(new_visibility)
+        project.errors.add(
+          :visibility_level,
+          "#{level_name} could not be set as visibility level of this project - parent project settings are more restrictive"
+        )
+        return false
+      end
+
       new_branch = params[:default_branch]
       if project.repository.exists? && new_branch && new_branch != project.default_branch