404 when attempting to import a GitLab export file

What does this MR do and why?

If a user cannot create a project because their project limit is 0, they should be clearly informed that they can't create projects, instead of seeing a blank 404 while attempting to access the project creation pages.

From looking at the user namespace policy and the User model, it seems like import_projects and create_projects abilities should relate to projects_limit, so I should not have to check projects_limit directly.

This MR changes:

  • projects/new from showing 404 to 403 with the message You do not have permission to create projects.
  • import/gitlab_project/new from showing 404 to 403 with the message You do not have permission to import projects into this namespace.
  • import/url/new from showing the Import form (despite user not having the permission) to a 403 with the message You do not have permission to import projects.

I'd started to update other import controllers but realized the approach to access gating isn't entirely uniform. So the MR only updates the paths that seemed to be a problem in the original bud report AND url import, which I am familiar with.

References

Screenshots or screen recordings

Before After
New project creation path
Screenshot 2026-03-18 at 3.56.20 PM.png Screenshot 2026-03-23 at 10.33.33 PM.png
GitLab Export
Screenshot 2026-03-24 at 7.27.00 PM.png Screenshot 2026-03-24 at 8.11.54 PM.png
Project Import via URL
Screenshot 2026-03-23 at 10.57.49 PM.png Screenshot 2026-03-24 at 8.14.25 PM.png

How to set up and validate locally

  1. As admin, choose a user, preferably one with 0 as their projects count in admin/users. Or create a user
  2. Edit the user, and under "Access" change "Project limits" to 0 and save.
  3. Click Impersonate on the user's page
  4. Attempt to access projects/new page
  5. Attempt to view /import/url/new page and import/gitlab_project/new
  6. Remember to return to the user and turn off impersonation.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #209220 (closed)

Edited by Oiza Baiye

Merge request reports

Loading
Loading