Let non-members set confidential flag on issue

When creating an issue a logged in user should be able to set
the issue as confidential in a public project. This facilitates
the flow of reporting security issues as confidential in open source
public projects.

Changelog: fixed

app/policies/issue_policy.rb

@@ -69,6 +69,14 @@ class IssuePolicy < IssuablePolicy
   rule { persisted & can?(:admin_issue) }.policy do
     enable :set_issue_metadata
   end
+
+  rule { can?(:set_issue_metadata) }.policy do
+    enable :set_confidentiality
+  end
+
+  rule { ~persisted & can?(:create_issue) }.policy do
+    enable :set_confidentiality
+  end
 end
 
 IssuePolicy.prepend_mod_with('IssuePolicy')

app/services/issuable_base_service.rb

@@ -51,9 +51,12 @@ class IssuableBaseService < ::BaseProjectService
       params.delete(:canonical_issue_id)
       params.delete(:project)
       params.delete(:discussion_locked)
-      params.delete(:confidential)
     end
 
+    # confidential attribute is a special type of metadata and needs to be allowed to be set
+    # by non-members on issues in public projects so that security issues can be reported as confidential.
+    params.delete(:confidential) unless can?(current_user, :set_confidentiality, issuable)
+
     filter_assignees(issuable)
     filter_milestone
     filter_labels

app/views/shared/issuable/form/_metadata.html.haml

 - project = local_assigns.fetch(:project)
 - issuable = local_assigns.fetch(:issuable)
 - presenter = local_assigns.fetch(:presenter)
-
-- return unless can?(current_user, :"set_#{issuable.to_ability_name}_metadata", issuable)
-
 - has_due_date = issuable.has_attribute?(:due_date)
 - form = local_assigns.fetch(:form)
 
-- if issuable.respond_to?(:confidential)
+- if issuable.respond_to?(:confidential) && can?(current_user, :set_confidentiality, issuable)
   .form-group.row
     .offset-sm-2.col-sm-10
       .form-check
@@ -15,39 +12,40 @@
         = form.label :confidential, class: 'form-check-label' do
           This issue is confidential and should only be visible to team members with at least Reporter access.
 
-%hr
-.row
-  %div{ class: (has_due_date ? "col-lg-6" : "col-12") }
-    .form-group.row.merge-request-assignee
-      = render "shared/issuable/form/metadata_issuable_assignee", issuable: issuable, form: form, has_due_date: has_due_date
-
-    - if issuable.allows_reviewers?
-      .form-group.row.merge-request-reviewer
-        = render "shared/issuable/form/metadata_issuable_reviewer", issuable: issuable, form: form, has_due_date: has_due_date, presenter: presenter
+- if can?(current_user, :"set_#{issuable.to_ability_name}_metadata", issuable)
+  %hr
+  .row
+    %div{ class: (has_due_date ? "col-lg-6" : "col-12") }
+      .form-group.row.merge-request-assignee
+        = render "shared/issuable/form/metadata_issuable_assignee", issuable: issuable, form: form, has_due_date: has_due_date
 
-    = render_if_exists "shared/issuable/form/epic", issuable: issuable, form: form, project: project
-
-    - if issuable.supports_milestone?
-      .form-group.row.issue-milestone
-        = form.label :milestone_id, "Milestone", class: "col-form-label #{has_due_date ? "col-md-2 col-lg-4" : "col-sm-2"}"
-        .col-sm-10{ class: ("col-md-8" if has_due_date) }
-          .issuable-form-select-holder
-            = render "shared/issuable/milestone_dropdown", selected: issuable.milestone, name: "#{issuable.class.model_name.param_key}[milestone_id]", show_any: false, show_upcoming: false, show_started: false, extra_class: "qa-issuable-milestone-dropdown js-issuable-form-dropdown js-dropdown-keep-input", dropdown_title: "Select milestone"
+      - if issuable.allows_reviewers?
+        .form-group.row.merge-request-reviewer
+          = render "shared/issuable/form/metadata_issuable_reviewer", issuable: issuable, form: form, has_due_date: has_due_date, presenter: presenter
 
-    .form-group.row
-      = form.label :label_ids, "Labels", class: "col-form-label #{has_due_date ? "col-md-2 col-lg-4" : "col-sm-2"}"
-      = form.hidden_field :label_ids, multiple: true, value: ''
-      .col-sm-10{ class: "#{"col-md-8" if has_due_date}" }
-        .issuable-form-select-holder
-          = render "shared/issuable/label_dropdown", classes: ["js-issuable-form-dropdown"], selected: issuable.labels, data_options: { field_name: "#{issuable.class.model_name.param_key}[label_ids][]", show_any: false }, dropdown_title: "Select label"
+      = render_if_exists "shared/issuable/form/epic", issuable: issuable, form: form, project: project
 
-    = render_if_exists "shared/issuable/form/merge_request_blocks", issuable: issuable, form: form
+      - if issuable.supports_milestone?
+        .form-group.row.issue-milestone
+          = form.label :milestone_id, "Milestone", class: "col-form-label #{has_due_date ? "col-md-2 col-lg-4" : "col-sm-2"}"
+          .col-sm-10{ class: ("col-md-8" if has_due_date) }
+            .issuable-form-select-holder
+              = render "shared/issuable/milestone_dropdown", selected: issuable.milestone, name: "#{issuable.class.model_name.param_key}[milestone_id]", show_any: false, show_upcoming: false, show_started: false, extra_class: "qa-issuable-milestone-dropdown js-issuable-form-dropdown js-dropdown-keep-input", dropdown_title: "Select milestone"
 
-  - if has_due_date
-    .col-lg-6
-      = render_if_exists "shared/issuable/form/weight", issuable: issuable, form: form
       .form-group.row
-        = form.label :due_date, "Due date", class: "col-form-label col-md-2 col-lg-4"
-        .col-8
+        = form.label :label_ids, "Labels", class: "col-form-label #{has_due_date ? "col-md-2 col-lg-4" : "col-sm-2"}"
+        = form.hidden_field :label_ids, multiple: true, value: ''
+        .col-sm-10{ class: "#{"col-md-8" if has_due_date}" }
           .issuable-form-select-holder
-            = form.text_field :due_date, id: "issuable-due-date", class: "datepicker form-control", placeholder: "Select due date", autocomplete: 'off'
+            = render "shared/issuable/label_dropdown", classes: ["js-issuable-form-dropdown"], selected: issuable.labels, data_options: { field_name: "#{issuable.class.model_name.param_key}[label_ids][]", show_any: false }, dropdown_title: "Select label"
+
+      = render_if_exists "shared/issuable/form/merge_request_blocks", issuable: issuable, form: form
+
+    - if has_due_date
+      .col-lg-6
+        = render_if_exists "shared/issuable/form/weight", issuable: issuable, form: form
+        .form-group.row
+          = form.label :due_date, "Due date", class: "col-form-label col-md-2 col-lg-4"
+          .col-8
+            .issuable-form-select-holder
+              = form.text_field :due_date, id: "issuable-due-date", class: "datepicker form-control", placeholder: "Select due date", autocomplete: 'off'

ee/app/policies/epic_policy.rb

@@ -38,5 +38,6 @@ class EpicPolicy < BasePolicy
 
   rule { can?(:admin_epic) }.policy do
     enable :set_epic_metadata
+    enable :set_confidentiality
   end
 end