Merge branch 'master' into 28869-es6-modules28869-es6-modules

* master: (117 commits)
  small change to make less conflict with EE version
  Add cop for use of remove_column
  Resolve merge conflicts with dev.gitlab.org/master after security release
  add index for doc/administration/operations/
  Remove RubySampler#sample_objects for performance as well
  Bugfix: User can't change the access level of an access requester
  Add spec for removing issues.assignee_id
  updated imports
  Keep track of storage check timings
  Remove a header level in the new 'Automatic CE->EE merge' doc
  Improve down step of removing issues.assignee_id column
  Fix specs after removing assignee_id field
  Remove issues.assignee_id column
  Resolve conflicts in app/models/user.rb
  Fix image view mode
  Do not raise when downstream pipeline is created
  Remove the need for destroy and add a comment in the spec
  Use build instead of create in importer spec
  Simplify normalizing of paths
  Remove allocation tracking code from InfluxDB sampler for performance
  ...

1 files changed, 2 insertions, 0 deletions

diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index e60e00d7956..5f943ba27d1 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -161,6 +161,8 @@ module API
         use :issue_params
       end
       post ':id/issues' do
+        authorize! :create_issue, user_project
+
         # Setting created_at time only allowed for admins and project owners
         unless current_user.admin? || user_project.owner == current_user
           params.delete(:created_at)