Fixed permissions around create new list button

2 files changed, 28 insertions, 2 deletions

diff --git a/app/views/shared/issuable/_filter.html.haml b/app/views/shared/issuable/_filter.html.haml
index 949592a36eb..ffe8d4fbdbf 100644
--- a/app/views/shared/issuable/_filter.html.haml
+++ b/app/views/shared/issuable/_filter.html.haml
@@ -29,7 +29,7 @@
         .pull-right
           - if controller.controller_name != 'boards'
             = render 'shared/sort_dropdown'
-          - elsif current_user
+          - if can?(current_user, :admin_list, @project)
             .dropdown
               %button.btn.btn-create.js-new-board-list{ type: "button", data: { toggle: "dropdown", labels: labels_filter_path, project_id: @project.try(:id) } }
                 Create new list
diff --git a/spec/features/boards/boards_spec.rb b/spec/features/boards/boards_spec.rb
index cf20ca90b21..2864784559b 100644
--- a/spec/features/boards/boards_spec.rb
+++ b/spec/features/boards/boards_spec.rb
@@ -3,7 +3,7 @@ require 'rails_helper'
 describe 'Issue Boards', feature: true, js: true do
   include WaitForAjax
 
-  let(:project) { create(:empty_project) }
+  let(:project) { create(:empty_project, :public) }
   let(:user)    { create(:user) }
   let!(:user2)  { create(:user) }
 
@@ -561,6 +561,32 @@ describe 'Issue Boards', feature: true, js: true do
     end
   end
 
+  context 'signed out user' do
+    before do
+      logout
+      visit namespace_project_board_path(project.namespace, project)
+    end
+
+    it 'does not show create new list' do
+      expect(page).not_to have_selector('.js-new-board-list')
+    end
+  end
+
+  context 'as guest user' do
+    let(:user_guest) { create(:user) }
+
+    before do
+      project.team << [user_guest, :guest]
+      logout
+      login_as(user_guest)
+      visit namespace_project_board_path(project.namespace, project)
+    end
+
+    it 'does not show create new list' do
+      expect(page).not_to have_selector('.js-new-board-list')
+    end
+  end
+
   def drag_to(list_from_index: 0, card_index: 0, to_index: 0, list_to_index: 0, selector: '.board-list')
     evaluate_script("simulateDrag({scrollable: document.getElementById('board-app'), from: {el: $('#{selector}').eq(#{list_from_index}).get(0), index: #{card_index}}, to: {el: $('.board-list').eq(#{list_to_index}).get(0), index: #{to_index}}});")