Project milestones accessible if project issue tracker has restricted visibility

When restricting the issue tracker visibility the menu item for Milestones is also hidden, however, the path is still available: users can still point their browser to /milestones to see the project milestones and members can still manage them.

Restricting access could mean:

• Disabling the issue tracker completely
• Restricting access to members only on a public project

The milestones are still usable on merge requests.