Allow forking of public projects by authenticated users. Fixes #4152

app/models/ability.rb

@@ -38,10 +38,14 @@ class Ability
       elsif team.reporters.include?(user)
         rules << project_report_rules
 
-      elsif team.guests.include?(user) or project.public?
+      elsif team.guests.include?(user)
         rules << project_guest_rules
       end
 
+      if project.public?
+        rules << public_project_rules
+      end
+
       if project.owner == user || user.admin?
         rules << project_admin_rules
       end
@@ -49,6 +53,23 @@ class Ability
       rules.flatten
     end
 
+    def public_project_rules
+      [
+        :download_code,
+        :fork_project,
+        :read_project,
+        :read_wiki,
+        :read_issue,
+        :read_milestone,
+        :read_project_snippet,
+        :read_team_member,
+        :read_merge_request,
+        :read_note,
+        :write_issue,
+        :write_note
+      ]
+    end
+
     def project_guest_rules
       [
         :read_project,