Private project's namespace and name leak in new MR view
As described in https://gitlab.com/gitlab-org/gitlab-ce/issues/15532#guessing-namespaces, on the new MR (compare) view, you can see a private project's namespace and name by simply putting merge_request%5Btarget_project_id%5D=3 in the URL.
For instance, in my local setup, the twitter/flight project is private to my current user1 but I can see its namespace and name in the view:
As a fix, I suggest adding the following change in MergeRequests::BuildService#execute:
def execute
merge_request = MergeRequest.new(params)
# Set MR attributes
merge_request.can_be_created = false
merge_request.compare_commits = []
merge_request.source_project = project unless merge_request.source_project
+ merge_request.target_project = nil unless can?(current_user, :read_project, merge_request.target_project)
merge_request.target_project ||= (project.forked_from_project || project)
merge_request.target_branch ||= merge_request.target_project.default_branch