Don't show references to Pages when not available

In this instance its subgroups, and given we can't deploy it, we
shouldn't allow it to be shown.

Fixes gitlab-org/gitlab-ce#34864

8 files changed, 50 insertions, 4 deletions

diff --git a/app/controllers/projects/application_controller.rb b/app/controllers/projects/application_controller.rb
index 221e01b415a..d7dd8ddcb7d 100644
--- a/app/controllers/projects/application_controller.rb
+++ b/app/controllers/projects/application_controller.rb
@@ -94,6 +94,6 @@ class Projects::ApplicationController < ApplicationController
   end
 
   def require_pages_enabled!
-    not_found unless Gitlab.config.pages.enabled
+    not_found unless @project.pages_available?
   end
 end
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index e7bc1d1b080..e7cbc5170e8 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -195,6 +195,10 @@ class Namespace < ActiveRecord::Base
     parent.present?
   end
 
+  def subgroup?
+    has_parent?
+  end
+
   def soft_delete_without_removing_associations
     # We can't use paranoia's `#destroy` since this will hard-delete projects.
     # Project uses `pending_delete` instead of the acts_as_paranoia gem.
diff --git a/app/models/project.rb b/app/models/project.rb
index d5324ceac31..db7183e4c9a 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1235,6 +1235,10 @@ class Project < ActiveRecord::Base
     File.join(pages_path, 'public')
   end
 
+  def pages_available?
+    Gitlab.config.pages.enabled && !namespace.subgroup?
+  end
+
   def remove_private_deploy_keys
     exclude_keys_linked_to_other_projects = <<-SQL
       NOT EXISTS (
diff --git a/app/views/layouts/nav/_new_project_sidebar.html.haml b/app/views/layouts/nav/_new_project_sidebar.html.haml
index 341943cf833..6ae816d0bbb 100644
--- a/app/views/layouts/nav/_new_project_sidebar.html.haml
+++ b/app/views/layouts/nav/_new_project_sidebar.html.haml
@@ -208,7 +208,7 @@
                   = link_to project_settings_ci_cd_path(@project), title: 'CI / CD' do
                     %span
                       CI / CD
-              - if Gitlab.config.pages.enabled
+              - if @project.pages_available?
                 = nav_link(controller: :pages) do
                   = link_to project_pages_path(@project), title: 'Pages' do
                     %span
diff --git a/app/views/projects/settings/_head.html.haml b/app/views/projects/settings/_head.html.haml
index 15ba09b10ba..7d24c6a9122 100644
--- a/app/views/projects/settings/_head.html.haml
+++ b/app/views/projects/settings/_head.html.haml
@@ -23,7 +23,7 @@
               = link_to project_settings_ci_cd_path(@project), title: 'Pipelines' do
                 %span
                   Pipelines
-          - if Gitlab.config.pages.enabled
+          - if @project.pages_available?
             = nav_link(controller: :pages) do
               = link_to project_pages_path(@project), title: 'Pages' do
                 %span
diff --git a/changelogs/unreleased/zj-disable-pages-in-subgroups.yml b/changelogs/unreleased/zj-disable-pages-in-subgroups.yml
new file mode 100644
index 00000000000..22c36214e1f
--- /dev/null
+++ b/changelogs/unreleased/zj-disable-pages-in-subgroups.yml
@@ -0,0 +1,5 @@
+---
+title: Remove pages settings when not available
+merge_request:
+author:
+type: changed
diff --git a/spec/controllers/projects/pages_controller_spec.rb b/spec/controllers/projects/pages_controller_spec.rb
index 4d0111302f3..83c7744a231 100644
--- a/spec/controllers/projects/pages_controller_spec.rb
+++ b/spec/controllers/projects/pages_controller_spec.rb
@@ -2,7 +2,7 @@ require 'spec_helper'
 
 describe Projects::PagesController do
   let(:user) { create(:user) }
-  let(:project) { create(:project, :public, :access_requestable) }
+  let(:project) { create(:project, :public) }
 
   let(:request_params) do
     {
@@ -23,6 +23,17 @@ describe Projects::PagesController do
 
       expect(response).to have_http_status(200)
     end
+
+    context 'when the project is in a subgroup' do
+      let(:group) { create(:group, :nested) }
+      let(:project) { create(:project, namespace: group) }
+
+      it 'returns a 404 status code' do
+        get :show, request_params
+
+        expect(response).to have_http_status(404)
+      end
+    end
   end
 
   describe 'DELETE destroy' do
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 2e613c44357..867f629264c 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -2225,6 +2225,28 @@ describe Project do
     end
   end
 
+  describe '#pages_available?' do
+    let(:project) { create(:project, group: group) }
+
+    subject { project.pages_available? }
+
+    before do
+      allow(Gitlab.config.pages).to receive(:enabled).and_return(true)
+    end
+
+    context 'when the project is in a top level namespace' do
+      let(:group) { create(:group) }
+
+      it { is_expected.to be(true) }
+    end
+
+    context 'when the project is in a subgroup' do
+      let(:group) { create(:group, :nested) }
+
+      it { is_expected.to be(false) }
+    end
+  end
+
   describe '#remove_private_deploy_keys' do
     let!(:project) { create(:project) }