The approvers list is not limited to people having access to the project when editing a merge request

Summary

When editing a merge request to override the approvals default settings, the approvers list is not limited to people having access to the project.

Steps to reproduce

Reproduce:

  1. In the project's settings, enable the Approvals and the ability to override the defaults
  2. Go to an MR and search for a group in the approvals section
  3. A list of all groups alphabetically is shown in the dropdown

What is the expected correct behavior?

According to the docs,

Eligible approvers can be individual users or groups that are project members, members of the project's immediate parent group, and members of a group who have access to the project via a share.

Relevant logs and/or screenshots

For example, editing https://gitlab.com/gitlab-com/gitlab-docs/merge_requests/194/edit

Screenshot-2018-2-13_Edit___WIP_Add_Nanoc_bootstrap_Dockerfile___194___Merge_Requests___GitLab_com_GitLab_Docs

Assignee Loading
Time tracking Loading