'New Epic' button is visible from Board list for users with Guest role

Summary

A user with guest permissions can see the "New Epic" button on lists of a board even though they do not have access to create epics.

Steps to reproduce

  1. Login as a user with guest max permissions on a group.
  2. Visit and epic board that has some lists
  3. Click the "New Epic" button
  4. Fill out a title
  5. Click "New Epic" button
  6. see the error message

Example Project

What is the current bug behavior?

Currently, a user with the "guest" max role can create an epic from a board list. The add will fail because they do not have permission.

What is the expected correct behavior?

It would be expected that the button does not exist for a user that does not have permission to create epics.

Relevant logs and/or screenshots

Here is what a user sees while trying to create an epic from a board as a guest user.

image

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 
(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes