Let non-members set confidential flag on issue

When creating an issue a logged in user should be able to set
the issue as confidential in a public project. This facilitates
the flow of reporting security issues as confidential in open source
public projects.

Changelog: fixed

app/policies/issue_policy.rb

@@ -69,6 +69,14 @@ class IssuePolicy < IssuablePolicy
   rule { persisted & can?(:admin_issue) }.policy do
     enable :set_issue_metadata
   end
+
+  rule { can?(:set_issue_metadata) }.policy do
+    enable :set_confidentiality
+  end
+
+  rule { ~persisted & can?(:create_issue) }.policy do
+    enable :set_confidentiality
+  end
 end
 
 IssuePolicy.prepend_mod_with('IssuePolicy')

app/services/issuable_base_service.rb

@@ -51,9 +51,12 @@ class IssuableBaseService < ::BaseProjectService
       params.delete(:canonical_issue_id)
       params.delete(:project)
       params.delete(:discussion_locked)
-      params.delete(:confidential)
     end
 
+    # confidential attribute is a special type of metadata and needs to be allowed to be set
+    # by non-members on issues in public projects so that security issues can be reported as confidential.
+    params.delete(:confidential) unless can?(current_user, :set_confidentiality, issuable)
+
     filter_assignees(issuable)
     filter_milestone
     filter_labels

app/views/shared/issuable/form/_metadata.html.haml

 - project = local_assigns.fetch(:project)
 - issuable = local_assigns.fetch(:issuable)
 - presenter = local_assigns.fetch(:presenter)
-
-- return unless can?(current_user, :"set_#{issuable.to_ability_name}_metadata", issuable)
-
 - has_due_date = issuable.has_attribute?(:due_date)
 - form = local_assigns.fetch(:form)
 
-- if issuable.respond_to?(:confidential)
+- if issuable.respond_to?(:confidential) && can?(current_user, :set_confidentiality, issuable)
   .form-group.row
     .offset-sm-2.col-sm-10
       .form-check
@@ -15,8 +12,9 @@
         = form.label :confidential, class: 'form-check-label' do
           This issue is confidential and should only be visible to team members with at least Reporter access.
 
-%hr
-.row
+- if can?(current_user, :"set_#{issuable.to_ability_name}_metadata", issuable)
+  %hr
+  .row
     %div{ class: (has_due_date ? "col-lg-6" : "col-12") }
       .form-group.row.merge-request-assignee
         = render "shared/issuable/form/metadata_issuable_assignee", issuable: issuable, form: form, has_due_date: has_due_date

ee/app/policies/epic_policy.rb

@@ -38,5 +38,6 @@ class EpicPolicy < BasePolicy
 
   rule { can?(:admin_epic) }.policy do
     enable :set_epic_metadata
+    enable :set_confidentiality
   end
 end