Update group links service

ee/app/services/ee/projects/group_links/create_service.rb

@@ -8,7 +8,10 @@ module EE
 
         override :execute
         def execute(group)
-          super.tap { |link| log_audit_event(link) if link && link&.persisted? }
+          result = super
+
+          log_audit_event(result[:link]) if result[:status] == :success
+          result
         end
 
         private

ee/changelogs/unreleased/2802-security-add-public-internal-groups-as-members-to-your-project-idor.yml

+---
+title: Remove the possibility to share a project with a group that a user is not a member
+  of
+merge_request:
+author:
+type: security

ee/spec/features/projects/members/invite_group_and_members_spec.rb

@@ -57,6 +57,7 @@ describe 'Project > Members > Invite group and members', :js do
 
       before do
         project.add_maintainer(maintainer)
+        group_to_share_with.add_developer(maintainer)
         sign_in(maintainer)
       end
 

ee/spec/services/projects/group_links/create_service_spec.rb

@@ -36,6 +36,7 @@ describe Projects::GroupLinks::CreateService, '#execute' do
   end
 
   def create_group_link(user, project, group, opts)
+    group.add_developer(user)
     described_class.new(project, user, opts).execute(group)
   end
 end