Attacker can extract list of private project's project members

There's a minor information disclosure issue in the Import members feature. It can be abused to get a list of project members that are working on a private project. The following steps require that you're signed in as a user that can create a new project. When someone imports project members from …

# app/controllers/projects/project_members_controller.rb:96
def apply_import
  giver = Project.find(params[:source_project_id])
  
  # ...

  redirect_to(namespace_project_project_members_path(project.namespace, project),
                notice: notice)
end