Skip to content

Fix parent groups authorization for member of child groups that has projects

!93601 (merged) introduced a new way to fetch epics on big group hierarchies for users with guest access or lower, but it also introduced a problem.

How to reproduce:

  1. Create a private Group A
  2. Add a subgroup B
  3. Add an user X to subgroup B
  4. Add a project Y to subgroup B

After step 4 user X should be able to read group A because subgroup B has a project, but now it does not happen.

If the user has direct authorization on Project Y then it will still behave as before, in this case, we are covered.

This is an old authorization inconsistency described at #36658 (closed) and #340421 (closed), but anyway previous behavior should be restored.

Edited by Felipe Cardozo