Remove Pull Project Code and Download Project from guest permissions on permissions.md page
This seems to have been added with 8.2. I see the checkboxes on the permissions pages were added with commit 910c2a50. This begs the question, was the doc wrong previously and guests could always pull code, or is this new behavior? Either way people such as myself have set up our groups with the understanding that guest users would be able to open issues but not get to the code, and either the most recent update totally screws our security, or this has been misdocumented long enough that the functionality should be changed to match the expected behavior.
Edit
After further investigation, it looks like the behavior hasn't changed. Our users are guests to private projects via guest membership in our development group. This was done with the expectation that they would be able to create issues, but not pull / view code. Having tested this after the update, it still seems to be the case that these users are not able to pull code via a git clone
which is the expected behavior. I believe the permissions page should be changed back or be more specific. To the best of my knowledge without looking it up, "Guest" permissions granted via public and internal visibility to non-project members allows viewing of code, but explicit guest permissions added via group membership or project membership to private projects do not. I'm not sure what the best way to reflect this in the checkboxes in permissions.md to make it clear at a glance without digging through the docs. What I do know is, I can't possibly be the only GitLab administrator who had a heart attack after updating to 8.2.