Fix namespace api autocomplete

1 files changed, 14 insertions, 5 deletions

diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index e9305b40836..6bd8111c2b2 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -5,13 +5,18 @@ module Gitlab
     end
 
     def user_project
-      if @project ||= current_user.projects.find_by_id(params[:id]) ||
-                      current_user.projects.find_by_path(params[:id])
+      @project ||= find_project
+      @project || not_found!
+    end
+
+    def find_project
+      project = Project.find_by_id(params[:id]) || Project.find_with_namespace(params[:id])
+
+      if project && can?(current_user, :read_project, project)
+        project
       else
-        not_found!
+        nil
       end
-
-      @project
     end
 
     def paginate(object)
@@ -32,6 +37,10 @@ module Gitlab
       end
     end
 
+    def can?(object, action, subject)
+      abilities.allowed?(object, action, subject)
+    end
+
     def attributes_for_keys(keys)
       attrs = {}
       keys.each do |key|