Add latest changes from gitlab-org/gitlab@master

2 files changed, 7 insertions, 1 deletions

diff --git a/app/controllers/profiles/notifications_controller.rb b/app/controllers/profiles/notifications_controller.rb
index 5f44e55f3ef..d295b64082c 100644
--- a/app/controllers/profiles/notifications_controller.rb
+++ b/app/controllers/profiles/notifications_controller.rb
@@ -11,6 +11,7 @@ class Profiles::NotificationsController < Profiles::ApplicationController
       exclude_group_ids: @group_notifications.select(:source_id)
     ).execute.map { |group| current_user.notification_settings_for(group, inherit: true) }
     @project_notifications = current_user.notification_settings.for_projects.order(:id)
+                             .select { |notification| current_user.can?(:read_project, notification.source) }
     @global_notification_setting = current_user.global_notification_setting
   end
   # rubocop: enable CodeReuse/ActiveRecord
diff --git a/app/controllers/projects/releases_controller.rb b/app/controllers/projects/releases_controller.rb
index ffe69fe97e4..d6030a9e455 100644
--- a/app/controllers/projects/releases_controller.rb
+++ b/app/controllers/projects/releases_controller.rb
@@ -10,7 +10,7 @@ class Projects::ReleasesController < Projects::ApplicationController
     push_frontend_feature_flag(:release_evidence_collection, project)
   end
   before_action :authorize_update_release!, only: %i[edit update]
-  before_action :authorize_download_code!, only: [:evidence]
+  before_action :authorize_read_release_evidence!, only: [:evidence]
 
   def index
     respond_to do |format|
@@ -47,6 +47,11 @@ class Projects::ReleasesController < Projects::ApplicationController
     access_denied! unless can?(current_user, :update_release, release)
   end
 
+  def authorize_read_release_evidence!
+    access_denied! unless Feature.enabled?(:release_evidence, project, default_enabled: true)
+    access_denied! unless can?(current_user, :read_release_evidence, release)
+  end
+
   def release
     @release ||= project.releases.find_by_tag!(sanitized_tag_name)
   end