block visibility level restriction override in controller

1 files changed, 15 insertions, 1 deletions

diff --git a/lib/gitlab/visibility_level.rb b/lib/gitlab/visibility_level.rb
index ea1319268f8..d0b6cde3c7e 100644
--- a/lib/gitlab/visibility_level.rb
+++ b/lib/gitlab/visibility_level.rb
@@ -23,7 +23,21 @@ module Gitlab
       end
 
       def allowed_for?(user, level)
-        user.is_admin? || !Gitlab.config.gitlab.restricted_visibility_levels.include?(level)
+        user.is_admin? || allowed_level?(level)
+      end
+
+      # Level can be a string `"public"` or a value `20`, first check if valid,
+      # then check if the corresponding string appears in the config
+      def allowed_level?(level)
+        if options.has_key?(level.to_s)
+          non_restricted_level?(level)
+        elsif options.has_value?(level.to_i)
+          non_restricted_level?(options.key(level.to_i).downcase)
+        end
+      end
+
+      def non_restricted_level?(level)
+        ! Gitlab.config.gitlab.restricted_visibility_levels.include?(level)
       end
     end