Project statistics are not shown when repository is disabled
Summary
Security update 11.8.1 has introduced check to not show statistics for users who cannot pull code.
The implementation uses :download_code
ability, however this ability is explicitly disabled when repository is disabled.
This means that even admin can't check storage consumption of project with disabled repository.
Since disabled repository does not mean the storage is freed, this hides storage consumption. Admins need to have correct information about storage. Owners also, since admins may ask them to reduce it...
Additionally project statistics may/will/should include storage not directly related to repository (e.g. #57822 (closed) for wiki). Ideally whole storage consumption should be shown in the future (e.g. packages, docker registry, ...)
Steps to reproduce
Disable project repository and check statistics via API.
Observe statistics not provided.
Example Project
https://gitlab.com/petermarko/no-statistics
https://gitlab.com/api/v4/projects/11460234?statistics=true
What is the current bug behavior?
Statistics are not reported wiht disabled repository even for owner or admin.
What is the expected correct behavior?
Statistics are reported unconditionally with sufficient access rights.
Relevant logs and/or screenshots
See example.
Output of checks
This bug happens on GitLab.com and also on self-managed instances.
Possible fixes
Rewrite https://gitlab.com/gitlab-org/gitlab-ce/commit/618b87448e9167f39d8216d1100733cc0fbf020b#cc752c66542cbeeb21ca7a57c430836b865580c9_275_274 to not depend on repository features.