Check source and target issues write access in order to return destroy link

app/services/issue_links/list_service.rb

@@ -3,7 +3,7 @@ module IssueLinks
     include Gitlab::Routing
 
     def initialize(issue, user)
-      @issue, @current_user = issue, user
+      @issue, @current_user, @project = issue, user, issue.project
     end
 
     def execute
@@ -45,12 +45,16 @@ module IssueLinks
     end
 
     def destroy_relation_path(issue)
-      return unless Ability.allowed?(@current_user, :admin_issue_link, issue.project)
+      return unless can_destroy_issue_link?(@project) && can_destroy_issue_link?(issue.project)
 
       namespace_project_issue_link_path(issue.project.namespace,
                                         issue.project,
                                         issue.iid,
                                         issue.issue_links_id)
     end
+
+    def can_destroy_issue_link?(project)
+      Ability.allowed?(@current_user, :admin_issue_link, project)
+    end
   end
 end

spec/services/issue_links/list_service_spec.rb

@@ -4,9 +4,10 @@ describe IssueLinks::ListService, service: true do
   let(:user) { create :user }
   let(:project) { create(:project_empty_repo) }
   let(:issue) { create :issue, project: project }
+  let(:user_role) { :developer }
 
   before do
-    project.team << [user, :developer]
+    project.team << [user, user_role]
   end
 
   describe '#execute' do
@@ -152,16 +153,26 @@ describe IssueLinks::ListService, service: true do
         create(:issue_link, source: issue, target: referenced_issue)
       end
 
-      context 'when user can admin related issues on one project' do
-        let(:unauthorized_project) { create :empty_project }
-        let(:referenced_issue) { create :issue, project: unauthorized_project }
+      context 'user can admin related issues just on target project' do
+        let(:user_role) { :guest }
+        let(:target_project) { create :empty_project }
+        let(:referenced_issue) { create :issue, project: target_project }
 
-        before do
-          # User can just see related issues
-          unauthorized_project.team << [user, :guest]
+        it 'returns no destroy relation path' do
+          target_project.add_developer(user)
+
+          expect(subject.first[:destroy_relation_path]).to be_nil
         end
+      end
+
+      context 'user can admin related issues just on source project' do
+        let(:user_role) { :developer }
+        let(:target_project) { create :empty_project }
+        let(:referenced_issue) { create :issue, project: target_project }
 
         it 'returns no destroy relation path' do
+          target_project.add_guest(user)
+
           expect(subject.first[:destroy_relation_path]).to be_nil
         end
       end