Add latest changes from gitlab-org/security/gitlab@16-3-stable-ee

2 files changed, 13 insertions, 6 deletions

diff --git a/lib/api/entities/project_import_status.rb b/lib/api/entities/project_import_status.rb
index 59388aacafd..a7e7cd9ff73 100644
--- a/lib/api/entities/project_import_status.rb
+++ b/lib/api/entities/project_import_status.rb
@@ -17,8 +17,15 @@ module API
         project.import_state&.relation_hard_failures(limit: 100) || []
       end
 
-      expose :import_error, documentation: { type: 'string', example: 'Error message' } do |project, _options|
-        project.import_state&.last_error
+      expose :import_error, documentation: { type: 'string', example: 'Error message' } do |project, options|
+        next unless options[:current_user]
+        next unless project.import_state&.last_error
+
+        if Ability.allowed?(options[:current_user], :read_import_error, project)
+          project.import_state&.last_error
+        else
+          _("Ask a maintainer to check the import status for more details.")
+        end
       end
 
       expose :stats, documentation: { type: 'object' } do |project, _options|
diff --git a/lib/api/project_import.rb b/lib/api/project_import.rb
index 6639b3ec346..c28d0ae2def 100644
--- a/lib/api/project_import.rb
+++ b/lib/api/project_import.rb
@@ -111,7 +111,7 @@ module API
         ).execute
 
         if response.success?
-          present(response.payload, with: Entities::ProjectImportStatus)
+          present(response.payload, with: Entities::ProjectImportStatus, current_user: current_user)
         else
           render_api_error!(response.message, response.http_status)
         end
@@ -134,7 +134,7 @@ module API
       end
       route_setting :skip_authentication, true
       get ':id/import' do
-        present user_project, with: Entities::ProjectImportStatus
+        present user_project, with: Entities::ProjectImportStatus, current_user: current_user
       end
 
       params do
@@ -182,7 +182,7 @@ module API
         ).execute
 
         if response.success?
-          present(response.payload, with: Entities::ProjectImportStatus)
+          present(response.payload, with: Entities::ProjectImportStatus, current_user: current_user)
         else
           render_api_error!(response.message, response.http_status)
         end
@@ -241,7 +241,7 @@ module API
         ).execute
 
         if response.success?
-          present(response.payload, with: Entities::ProjectImportStatus)
+          present(response.payload, with: Entities::ProjectImportStatus, current_user: current_user)
         else
           render_api_error!(response.message, response.http_status)
         end