Fix pages abilities

app/controllers/projects/pages_controller.rb

 class Projects::PagesController < Projects::ApplicationController
   layout 'project_settings'
 
-  before_action :authorize_update_pages!
+  before_action :authorize_read_pages!, only: [:show]
+  before_action :authorize_update_pages!, except: [:show]
 
   def show
     @domains = @project.pages_domains.order(:domain)

app/models/ability.rb

@@ -224,9 +224,11 @@ class Ability
 
     def project_master_rules
       @project_master_rules ||= project_dev_rules + [
+        :read_pages,
         :push_code_to_protected_branches,
         :update_project_snippet,
         :update_merge_request,
+        :update_pages,
         :admin_milestone,
         :admin_project_snippet,
         :admin_project_member,
@@ -235,7 +237,8 @@ class Ability
         :admin_wiki,
         :admin_project,
         :admin_commit_status,
-        :admin_build
+        :admin_build,
+        :admin_pages,
       ]
     end
 
@@ -245,7 +248,6 @@ class Ability
         :change_visibility_level,
         :rename_project,
         :remove_project,
-        :update_pages,
         :remove_pages,
         :archive_project,
         :remove_fork_project

app/views/projects/pages/_destroy.haml

@@ -7,3 +7,5 @@
         Removing the pages will prevent from exposing them to outside world.
       .form-actions
         = link_to 'Remove pages', namespace_project_pages_path(@project.namespace, @project), data: { confirm: 'Are you sure?'}, method: :delete, class: "btn btn-remove"
+- else
+  .nothing-here-block Only the project owner can remove pages

app/views/projects/pages/_list.html.haml

-- if @domains.any?
+- if can?(current_user, :update_pages, @project) && @domains.any?
   .panel.panel-default
     .panel-heading
       Domains (#{@domains.count})

app/views/projects/pages/_no_domains.html.haml

-.panel.panel-default
-  .panel-heading
-    Domains
-  .nothing-here-block
-    Support for domains and certificates is disabled.
-    Ask your system's administrator to enable it.
+- if can?(current_user, :update_pages, @project)
+  .panel.panel-default
+    .panel-heading
+      Domains
+    .nothing-here-block
+      Support for domains and certificates is disabled.
+      Ask your system's administrator to enable it.

app/views/projects/pages/show.html.haml

@@ -2,7 +2,7 @@
 %h3.page_title
   Pages
 
-  - if Gitlab.config.pages.external_http || Gitlab.config.pages.external_https
+  - if can?(current_user, :update_pages, @project) && (Gitlab.config.pages.external_http || Gitlab.config.pages.external_https)
     = link_to new_namespace_project_pages_domain_path(@project.namespace, @project), class: 'btn btn-new pull-right', title: 'New Domain' do
       %i.fa.fa-plus
       New Domain

doc/permissions/permissions.md

@@ -47,9 +47,12 @@ documentation](../workflow/add-user/add-user.md).
 | Manage runners                        |         |            |             | ✓        | ✓      |
 | Manage build triggers                 |         |            |             | ✓        | ✓      |
 | Manage variables                      |         |            |             | ✓        | ✓      |
+| Manage pages                          |         |            |             | ✓        | ✓      |
+| Manage pages domains and certificates |         |            |             | ✓        | ✓      |
 | Switch visibility level               |         |            |             |          | ✓      |
 | Transfer project to another namespace |         |            |             |          | ✓      |
 | Remove project                        |         |            |             |          | ✓      |
+| Remove pages                          |         |            |             |          | ✓      |
 | Force push to protected branches      |         |            |             |          |        |
 | Remove protected branches             |         |            |             |          |        |