Related Branches Visible to Guests in Issue Activity

This is related to gitlab-ce#56224

Summary

A Guest user in a private project, or a non-project member in a public project with Repository set as Project Members Only will see related branches in an issue's activity feed.

Steps to Reproduce

Private Project, Guest user

  1. Create a private project, and add a user as Guest
  2. As an authorized user, create an issue
  3. Within issue create related branch
  4. Login as user with Guest privileges and visit issue. The related branch will be seen in the activity feed.

Public Project, Repository as Project Members Only, non-project user

  1. Create a public project
  2. In project settings, set Repository to Project Members Only
  3. As an authorized project user, create an issue
  4. Within issue create related branch
  5. As a non-project user visit the issue. The related branch will be seen in the activity feed.
Assignee Loading
Time tracking Loading