Private group names are exposed to non-members - Groups tab

  1. Create a public project
  2. Go to Members page. Invite a group, select a private group
  3. Log out. Go to the members page. You can see the private group name in the Groups tab

Screenshot_2023-06-13_at_9.56.50_PM

What I see

The private group name, and path is shown on the Members page

What I expect to see

The private group is now shown at all on the Members page for unauthorized users or users without access to the private group.

Here are the mockups from @ameliabauerly (#387603 (comment 1446372784), #387603 (comment 1447280926)):

Group tab: image

Implementation plan

  • Ensure private group names are hidden from unauthorized users
  • Ensure this is implemented both for the group tab on the group and project members page
  • This change should be documented in the docs as part of implementing this issue
    • https://docs.gitlab.com/ee/user/project/members/share_project_with_groups.html
    • https://docs.gitlab.com/ee/user/group/manage.html#share-a-group-with-another-group

/cc @lohrc @gitlab-com/gl-security/appsec @alexpooley @lciutacu

Edited Oct 20, 2023 by Thong Kuah
Assignee Loading
Time tracking Loading