Merge branch '24056-guest-sees-some-project-details-and-gets-404' into 'master'

Fix: Guest sees some repository details and gets 404

Closes #24056

See merge request !7222

app/views/projects/show.html.haml

@@ -12,7 +12,7 @@
 = render 'projects/last_push'
 = render "home_panel"
 
-- if @project.feature_available?(:repository, current_user)
+- if current_user && can?(current_user, :download_code, @project)
   %nav.project-stats{ class: container_class }
     %ul.nav
       %li

changelogs/unreleased/24056-guest-sees-some-project-details-and-gets-404.yml

+---
+title: 'Fix: Guest sees some repository details and gets 404'
+merge_request: 
+author: 

spec/features/projects/features_visibility_spec.rb

@@ -183,4 +183,19 @@ describe 'Edit Project Settings', feature: true do
       end
     end
   end
+
+  # Regression spec for https://gitlab.com/gitlab-org/gitlab-ce/issues/24056
+  describe 'project statistic visibility' do
+    let!(:project) { create(:project, :private) }
+
+    before do
+      project.team << [member, :guest]
+      login_as(member)
+      visit namespace_project_path(project.namespace, project)
+    end
+
+    it "does not show project statistic for guest" do
+      expect(page).not_to have_selector('.project-stats')
+    end
+  end
 end