diff --git a/app/views/projects/show.html.haml b/app/views/projects/show.html.haml index ba16c641462aaebb5b9019c6fc0c0cbce9f8d816..d2570598501c9ff031eba0e7816b7b4fe4cfe9b9 100644 --- a/app/views/projects/show.html.haml +++ b/app/views/projects/show.html.haml @@ -12,7 +12,7 @@ = render 'projects/last_push' = render "home_panel" -- if @project.feature_available?(:repository, current_user) +- if current_user && can?(current_user, :download_code, @project) %nav.project-stats{ class: container_class } %ul.nav %li diff --git a/changelogs/unreleased/24056-guest-sees-some-project-details-and-gets-404.yml b/changelogs/unreleased/24056-guest-sees-some-project-details-and-gets-404.yml new file mode 100644 index 0000000000000000000000000000000000000000..8ca0c5beab306a3ef77bed3963c72f3f3e524fe1 --- /dev/null +++ b/changelogs/unreleased/24056-guest-sees-some-project-details-and-gets-404.yml @@ -0,0 +1,4 @@ +--- +title: 'Fix: Guest sees some repository details and gets 404' +merge_request: +author: diff --git a/spec/features/projects/features_visibility_spec.rb b/spec/features/projects/features_visibility_spec.rb index e796ee570b709f50c99b7cb8dc9b33617beb3e4b..09aa6758b5cae5603cc69d39707bd3c4893209fe 100644 --- a/spec/features/projects/features_visibility_spec.rb +++ b/spec/features/projects/features_visibility_spec.rb @@ -183,4 +183,19 @@ describe 'Edit Project Settings', feature: true do end end end + + # Regression spec for https://gitlab.com/gitlab-org/gitlab-ce/issues/24056 + describe 'project statistic visibility' do + let!(:project) { create(:project, :private) } + + before do + project.team << [member, :guest] + login_as(member) + visit namespace_project_path(project.namespace, project) + end + + it "does not show project statistic for guest" do + expect(page).not_to have_selector('.project-stats') + end + end end