Fix commit signature error when project is disabled

When a project is disabled, visiting the home page would show,
"An error occurred while loading commit signatures". This change checks
that the user has permission to view the project to avoid unnecessary
GPG signature lookups.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/50903

3 files changed, 24 insertions, 2 deletions

diff --git a/app/views/projects/show.html.haml b/app/views/projects/show.html.haml
index aba289c790f..283031b06da 100644
--- a/app/views/projects/show.html.haml
+++ b/app/views/projects/show.html.haml
@@ -8,8 +8,8 @@
 
 = render partial: 'flash_messages', locals: { project: @project }
 
-- if @project.repository_exists? && !@project.empty_repo?
-  - signatures_path = namespace_project_signatures_path(namespace_id: @project.namespace.full_path, project_id: @project.path, id: @project.default_branch)
+- if !@project.empty_repo? && can?(current_user, :download_code, @project)
+  - signatures_path = project_signatures_path(@project, @project.default_branch)
   .js-signature-container{ data: { 'signatures-path': signatures_path } }
 
 %div{ class: [container_class, ("limit-container-width" unless fluid_layout)] }
diff --git a/changelogs/unreleased/sh-fix-commit-signatures-error.yml b/changelogs/unreleased/sh-fix-commit-signatures-error.yml
new file mode 100644
index 00000000000..e2ea0e5857e
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-commit-signatures-error.yml
@@ -0,0 +1,5 @@
+---
+title: Fix commit signature error when project is disabled
+merge_request: 22344
+author:
+type: fixed
diff --git a/spec/features/projects_spec.rb b/spec/features/projects_spec.rb
index 8e310f38a8c..fb766addb31 100644
--- a/spec/features/projects_spec.rb
+++ b/spec/features/projects_spec.rb
@@ -193,6 +193,23 @@ describe 'Project' do
     end
   end
 
+  describe 'when the project repository is disabled', :js do
+    let(:user)    { create(:user) }
+    let(:project) { create(:project, :repository_disabled, :repository, namespace: user.namespace) }
+
+    before do
+      sign_in(user)
+      project.add_maintainer(user)
+      visit project_path(project)
+    end
+
+    it 'does not show an error' do
+      wait_for_requests
+
+      expect(page).not_to have_selector('.flash-alert')
+    end
+  end
+
   describe 'removal', :js do
     let(:user)    { create(:user) }
     let(:project) { create(:project, namespace: user.namespace) }