Non-admin users can set "Project Visibility" to "Public" when "Public" is disabled in admin "Restricted visibility" settings
When setting "Public" as a restricted visibility level in GitLab, non-admin users are still able to set "Project Visibility" to "Public" on project settings pages. When setting as "Public", it looks like this returns with success, but the dropdown is reverted back to "Private". Before 9.0.2, it wouldn't show the setting at all.
Steps to reproduce
- Mark "Public" in "Restricted visibility" admin settings for projects
- Impersonate a non-admin user
- Head to project settings to change visibility
What is the current bug behavior?
Non-admin users can set project to "Public"
What is the expected correct behavior?
Option shouldn't be visible