Add latest changes from gitlab-org/gitlab@master

3 files changed, 21 insertions, 40 deletions

diff --git a/app/services/issuable_links/create_service.rb b/app/services/issuable_links/create_service.rb
index f244f54b25f..1069c9e0915 100644
--- a/app/services/issuable_links/create_service.rb
+++ b/app/services/issuable_links/create_service.rb
@@ -19,6 +19,10 @@ module IssuableLinks
         return error(issuables_already_assigned_message, 409)
       end
 
+      if render_no_permission_error?
+        return error(issuables_no_permission_error_message, 403)
+      end
+
       if render_not_found_error?
         return error(issuables_not_found_message, 404)
       end
@@ -46,6 +50,7 @@ module IssuableLinks
 
       link
     end
+
     # rubocop: enable CodeReuse/ActiveRecord
 
     private
@@ -54,6 +59,10 @@ module IssuableLinks
       referenced_issuables.present? && (referenced_issuables - previous_related_issuables).empty?
     end
 
+    def render_no_permission_error?
+      readonly_issuables(referenced_issuables).present? && linkable_issuables(referenced_issuables).empty?
+    end
+
     def render_not_found_error?
       linkable_issuables(referenced_issuables).empty?
     end
@@ -116,6 +125,10 @@ module IssuableLinks
       _('%{issuable}(s) already assigned' % { issuable: target_issuable_type.capitalize })
     end
 
+    def issuables_no_permission_error_message
+      _("Couldn't link %{issuable}. You must have at least the Reporter role in both projects." % { issuable: target_issuable_type })
+    end
+
     def issuables_not_found_message
       _('No matching %{issuable} found. Make sure that you are adding a valid %{issuable} URL.' % { issuable: target_issuable_type })
     end
@@ -133,6 +146,10 @@ module IssuableLinks
       raise NotImplementedError
     end
 
+    def readonly_issuables(_issuables)
+      [] # default to empty for non-issues
+    end
+
     def previous_related_issuables
       raise NotImplementedError
     end
diff --git a/app/services/issue_links/create_service.rb b/app/services/issue_links/create_service.rb
index 80c6af88f21..db05920678e 100644
--- a/app/services/issue_links/create_service.rb
+++ b/app/services/issue_links/create_service.rb
@@ -14,6 +14,10 @@ module IssueLinks
 
     private
 
+    def readonly_issuables(issuables)
+      @readonly_issuables ||= issuables.select { |issuable| issuable.readable_by?(current_user) }
+    end
+
     def track_event
       track_incident_action(current_user, issuable, :incident_relate)
     end
diff --git a/app/services/work_items/widgets/milestone_service/base_service.rb b/app/services/work_items/widgets/milestone_service/base_service.rb
deleted file mode 100644
index e9dc56cb6df..00000000000
--- a/app/services/work_items/widgets/milestone_service/base_service.rb
+++ /dev/null
@@ -1,40 +0,0 @@
-# frozen_string_literal: true
-
-module WorkItems
-  module Widgets
-    module MilestoneService
-      class BaseService < WorkItems::Widgets::BaseService
-        private
-
-        def handle_milestone_change(params:)
-          return unless params.present? && params.key?(:milestone_id)
-
-          unless has_permission?(:set_work_item_metadata)
-            params.delete(:milestone_id)
-            return
-          end
-
-          if params[:milestone_id].nil?
-            work_item.milestone = nil
-
-            return
-          end
-
-          resource_group = work_item.project&.group || work_item.namespace
-          project_ids = [work_item.project&.id].compact
-          milestone = MilestonesFinder.new({
-            project_ids: project_ids,
-            group_ids: resource_group&.self_and_ancestors&.select(:id),
-            ids: [params[:milestone_id]]
-          }).execute.first
-
-          if milestone
-            work_item.milestone = milestone
-          else
-            params.delete(:milestone_id)
-          end
-        end
-      end
-    end
-  end
-end