4 files changed, 53 insertions, 10 deletions
diff --git a/app/services/issues/base_service.rb b/app/services/issues/base_service.rb
index 0ed2b08b7b1..978ea6fe9bc 100644
--- a/app/services/issues/base_service.rb
+++ b/app/services/issues/base_service.rb
@@ -34,6 +34,18 @@ module Issues
 
     private
 
+    def filter_params(merge_request)
+      super
+
+      moved_issue = params.delete(:moved_issue)
+
+      # Setting created_at, updated_at and iid is allowed only for admins and owners or
+      # when moving an issue as we preserve the original issue attributes except id and iid.
+      params.delete(:iid) unless current_user.can?(:set_issue_iid, project)
+      params.delete(:created_at) unless moved_issue || current_user.can?(:set_issue_created_at, project)
+      params.delete(:updated_at) unless moved_issue || current_user.can?(:set_issue_updated_at, project)
+    end
+
     def create_assignee_note(issue, old_assignees)
       SystemNoteService.change_issuable_assignees(
         issue, issue.project, current_user, old_assignees)
diff --git a/app/services/issues/build_service.rb b/app/services/issues/build_service.rb
index 2de6ed9fa1c..3145739fe91 100644
--- a/app/services/issues/build_service.rb
+++ b/app/services/issues/build_service.rb
@@ -64,20 +64,26 @@ module Issues
 
     private
 
-    def whitelisted_issue_params
-      base_params = [:title, :description, :confidential]
-      admin_params = [:milestone_id, :issue_type]
+    def allowed_issue_base_params
+      [:title, :description, :confidential, :issue_type]
+    end
+
+    def allowed_issue_admin_params
+      [:milestone_id]
+    end
 
+    def allowed_issue_params
       if can?(current_user, :admin_issue, project)
-        params.slice(*(base_params + admin_params))
+        params.slice(*(allowed_issue_base_params + allowed_issue_admin_params))
       else
-        params.slice(*base_params)
+        params.slice(*allowed_issue_base_params)
       end
     end
 
     def build_issue_params
-      { author: current_user }.merge(issue_params_with_info_from_discussions)
-        .merge(whitelisted_issue_params)
+      { author: current_user }
+        .merge(issue_params_with_info_from_discussions)
+        .merge(allowed_issue_params)
     end
   end
 end
diff --git a/app/services/issues/move_service.rb b/app/services/issues/move_service.rb
index 60e0d1eec3d..90ccbd8ed21 100644
--- a/app/services/issues/move_service.rb
+++ b/app/services/issues/move_service.rb
@@ -23,11 +23,15 @@ module Issues
       # to receive service desk emails on the new moved issue.
       update_service_desk_sent_notifications
 
+      queue_copy_designs
+
       new_entity
     end
 
     private
 
+    attr_reader :target_project
+
     def update_service_desk_sent_notifications
       return unless original_entity.from_service_desk?
 
@@ -46,9 +50,10 @@ module Issues
       new_params = {
                      id: nil,
                      iid: nil,
-                     project: @target_project,
+                     project: target_project,
                      author: original_entity.author,
-                     assignee_ids: original_entity.assignee_ids
+                     assignee_ids: original_entity.assignee_ids,
+                     moved_issue: true
                    }
 
       new_params = original_entity.serializable_hash.symbolize_keys.merge(new_params)
@@ -58,6 +63,18 @@ module Issues
       CreateService.new(@target_project, @current_user, new_params).execute(skip_system_notes: true)
     end
 
+    def queue_copy_designs
+      return unless original_entity.designs.present?
+
+      response = DesignManagement::CopyDesignCollection::QueueService.new(
+        current_user,
+        original_entity,
+        new_entity
+      ).execute
+
+      log_error(response.message) if response.error?
+    end
+
     def mark_as_moved
       original_entity.update(moved_to: new_entity)
     end
@@ -75,7 +92,7 @@ module Issues
     end
 
     def add_note_from
-      SystemNoteService.noteable_moved(new_entity, @target_project,
+      SystemNoteService.noteable_moved(new_entity, target_project,
                                        original_entity, current_user,
                                        direction: :from)
     end
diff --git a/app/services/issues/reopen_service.rb b/app/services/issues/reopen_service.rb
index e2b1b5400c7..12dbff57ec5 100644
--- a/app/services/issues/reopen_service.rb
+++ b/app/services/issues/reopen_service.rb
@@ -5,6 +5,8 @@ module Issues
     def execute(issue)
       return issue unless can?(current_user, :reopen_issue, issue)
 
+      before_reopen(issue)
+
       if issue.reopen
         event_service.reopen_issue(issue, current_user)
         create_note(issue, 'reopened')
@@ -21,8 +23,14 @@ module Issues
 
     private
 
+    def before_reopen(issue)
+      # Overriden in EE
+    end
+
     def create_note(issue, state = issue.state)
       SystemNoteService.change_status(issue, issue.project, current_user, state, nil)
     end
   end
 end
+
+Issues::ReopenService.prepend_if_ee('EE::Issues::ReopenService')