Merge remote-tracking branch 'upstream/master' into pipeline-emails

* upstream/master: (237 commits)
  Grapify boards API
  Add test, fix merge error
  Use local assigns to get the dropdown title
  Updated issuable dropdown titles
  Added safety check for formatted values
  Minor style improvement
  Fixed conflict and corrected teaspoon test
  Rename method in test
  Moved ci_status environments logic to new action ci_envrionments_status and set up frontend polling
  Refactor ci_status on MergeRequestController
  Fix indenting error in HAML
  Show what time ago a MR was deployed
  Fixed missing links
  Fixed missing links
  Refactor merge requests revisions
  Add link to update docs for source installations
  Grapify todos API
  Link to review apps example from docs
  fix grafana_configuration.md move link
  Do not run before_script, artifacts, cache in trigger_docs job
  ...

1 files changed, 6 insertions, 0 deletions

diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index c24e8e8bd9b..da16e24d7ea 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -416,6 +416,12 @@ module API
         required_attributes! [:group_id, :group_access]
         attrs = attributes_for_keys [:group_id, :group_access, :expires_at]
 
+        group = Group.find_by_id(attrs[:group_id])
+
+        unless group && can?(current_user, :read_group, group)
+          not_found!('Group')
+        end
+
         unless user_project.allowed_to_share_with_group?
           return render_api_error!("The project sharing with group is disabled", 400)
         end