Skip to content

Hide "Suggest wiki improvement" button from Auditors on "Wiki" pages

📖 What does this MR do?

Related to #324972 (closed)

Hides "Suggest wiki improvement" button from Auditors on "Project" -> "Wiki" page. Auditors have read-only access to all projects on the GitLab instance so clicking that button returns a 404.

💻 Local testing

  1. Log in with an admin account (root)
  2. Navigate to /admin/users/new
  3. Fill out required fields and choose "Auditor" in the "Access level"
  4. Create a new project
  5. Log out and then log in with newly create Auditor account
  6. Navigate to newly created project -> "Wiki"

📷 Screenshots

View Before After
Auditor that is not a member of project Screen_Shot_2021-03-18_at_11.20.41_AM Screen_Shot_2021-03-18_at_11.06.09_AM

Below screenshots should be the same

View Before After
Auditor that is member of project Screen_Shot_2021-03-18_at_11.21.06_AM Screen_Shot_2021-03-18_at_11.06.24_AM
Regular user that is member of project Screen_Shot_2021-03-18_at_11.21.31_AM Screen_Shot_2021-03-18_at_11.07.22_AM
Logged out user Screen_Shot_2021-03-18_at_11.21.51_AM Screen_Shot_2021-03-18_at_11.06.47_AM

🚦 Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Peter Hegman

Merge request reports

Loading