diff --git a/lib/scm/gitlab.class.php b/lib/scm/gitlab.class.php
index 2ac9958d55..c36170fa3b 100644
--- a/lib/scm/gitlab.class.php
+++ b/lib/scm/gitlab.class.php
@@ -42,7 +42,7 @@ class gitlab
         $param->recursive = 0;
         if(!empty($this->branch)) $param->ref = $this->branch;
 
-        $list = $this->fetch($api, $param);
+        $list = $this->fetch($api, $param, true);
         if(empty($list)) return array();
 
         $infos = array();
@@ -709,22 +709,38 @@ class gitlab
      * @access public
      * @return mixed
      */
-    public function fetch($api, $params = array())
+    public function fetch($api, $params = array(), $needToLoop = false)
     {
         $params = (array) $params;
         $params['private_token'] = $this->token;
+        $params['per_page']      = 100;
 
         $api = ltrim($api, '/');
         $api = $this->root . $api . '?' . http_build_query($params);
-
-        $response = commonModel::http($api);
-        if(!empty(commonModel::$requestErrors))
+        if($needToLoop)
         {
-            commonModel::$requestErrors = array();
-            return array();
-        }
+            $allResults = array();
+            for($page = 1; true; $page++)
+            {
+                $results = json_decode(commonModel::http($api . "&page={$page}"));
+                if(!is_array($results)) break;
+                if(!empty($results)) $allResults = array_merge($allResults, $results);
+                if(count($results) < 100) break;
+            }
 
-        return json_decode($response);
+            return $allResults;
+        }
+        else
+        {
+            $response = commonModel::http($api);
+            if(!empty(commonModel::$requestErrors))
+            {
+                commonModel::$requestErrors = array();
+                return array();
+            }
+
+            return json_decode($response);
+        }
     }
 
     /**
diff --git a/module/gitlab/config.php b/module/gitlab/config.php
index 9997002e5b..044da832df 100644
--- a/module/gitlab/config.php
+++ b/module/gitlab/config.php
@@ -117,6 +117,7 @@ $config->gitlab->objectTypes['story'] = '需求';
 
 $config->gitlab->accessLevel = array();
 $config->gitlab->accessLevel['guest']      = 10;
+$config->gitlab->accessLevel['reporter']   = 20;
 $config->gitlab->accessLevel['developer']  = 30;
 $config->gitlab->accessLevel['maintainer'] = 40;
 $config->gitlab->accessLevel['owner']      = 50;
diff --git a/module/gitlab/control.php b/module/gitlab/control.php
index 87c90864b0..1c85398211 100644
--- a/module/gitlab/control.php
+++ b/module/gitlab/control.php
@@ -314,7 +314,7 @@ class gitlab extends control
         }
 
         $groups      = $this->gitlab->apiGetGroups($gitlabID, $orderBy);
-        $adminGroups = $this->gitlab->apiGetGroups($gitlabID, $orderBy, $this->config->gitlab->accessLevel['maintainer']);
+        $adminGroups = $this->gitlab->apiGetGroups($gitlabID, $orderBy, $this->config->gitlab->accessLevel['owner']);
 
         $adminGropuIDList = array();
         foreach($adminGroups as $group) $adminGropuIDList[] = $group->id;
@@ -374,7 +374,7 @@ class gitlab extends control
             if(!$openID) return print(js::alert($this->lang->gitlab->mustBindUser) . js::locate($this->createLink('gitlab', 'browse')));
 
             $members = $this->gitlab->apiGetGroupMembers($gitlabID, $groupID, $openID);
-            if(empty($members)) return print(js::alert($this->lang->gitlab->noAccess) . js::locate($this->createLink('gitlab', 'browse')));
+            if(empty($members) or $members[0]->access_level < $this->config->gitlab->accessLevel['owner']) return print(js::alert($this->lang->gitlab->noAccess) . js::locate($this->createLink('gitlab', 'browse')));
         }
 
         if($_POST)
@@ -405,19 +405,21 @@ class gitlab extends control
      */
     public function deleteGroup($gitlabID, $groupID, $confirm = 'no')
     {
-        if($confirm != 'yes') die(js::confirm($this->lang->gitlab->group->confirmDelete , inlink('deleteGroup', "gitlabID=$gitlabID&groupID=$groupID&confirm=yes")));
+        if($confirm != 'yes') return print(js::confirm($this->lang->gitlab->group->confirmDelete , inlink('deleteGroup', "gitlabID=$gitlabID&groupID=$groupID&confirm=yes")));
 
-        $group   = $this->gitlab->apiGetSingleGroup($gitlabID, $groupID);
-        $reponse = $this->gitlab->apiDeleteGroup($gitlabID, $groupID);
+        $group    = $this->gitlab->apiGetSingleGroup($gitlabID, $groupID);
+        $response = $this->gitlab->apiDeleteGroup($gitlabID, $groupID);
 
         /* If the status code beginning with 20 is returned or empty is returned, it is successful. */
-        if(!$reponse or substr($reponse->message, 0, 2) == '20')
+        if(!$response or substr($response->message, 0, 2) == '20')
         {
             $this->loadModel('action')->create('gitlabgroup', $groupID, 'deleted', '', $group->name);
-            die(js::reload('parent'));
+            return print(js::reload('parent'));
         }
 
-        die(js::alert($reponse->message));
+        $errorKey = array_search($response->message, $this->lang->gitlab->apiError);
+        $result   = $errorKey === false ? $response->message : zget($this->lang->gitlab->errorLang, $errorKey);
+        return print(js::alert($result));
     }
 
     /**
diff --git a/module/gitlab/model.php b/module/gitlab/model.php
index e841d98595..13c4af1db6 100644
--- a/module/gitlab/model.php
+++ b/module/gitlab/model.php
@@ -560,7 +560,7 @@ class gitlabModel extends model
             $results = json_decode(commonModel::http($url . "&&page={$page}&per_page=100"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
-            if(count($results)<100) break;
+            if(count($results) < 100) break;
         }
 
         return $allResults;
@@ -584,7 +584,7 @@ class gitlabModel extends model
             $results = json_decode(commonModel::http($url . "&&page={$page}&per_page=100"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
-            if(count($results)<100) break;
+            if(count($results) < 100) break;
         }
 
         return $allResults;
@@ -612,7 +612,7 @@ class gitlabModel extends model
             $results = json_decode(commonModel::http($url . "&statistics=true&order_by={$order}&sort={$sort}&page={$page}&per_page=100&all_available=true"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
-            if(count($results)<100 or $page > 10) break;
+            if(count($results) < 100 or $page > 10) break;
         }
 
         return $allResults;
@@ -669,11 +669,12 @@ class gitlabModel extends model
     /**
      * Get projects of one gitlab.
      *
-     * @param  int $gitlabID
+     * @param  int    $gitlabID
+     * @param  string $simple
      * @access public
      * @return array
      */
-    public function apiGetProjects($gitlabID)
+    public function apiGetProjects($gitlabID, $simple = 'true')
     {
         $apiRoot = $this->getApiRoot($gitlabID);
         if(!$apiRoot) return array();
@@ -683,10 +684,10 @@ class gitlabModel extends model
         $allResults = array();
         for($page = 1; true; $page++)
         {
-            $results = json_decode(commonModel::http($url . "&page={$page}&per_page=100"));
+            $results = json_decode(commonModel::http($url . "&simple={$simple}&page={$page}&per_page=100"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
-            if(count($results)<100 or $page > 10) break;
+            if(count($results) < 100 or $page > 10) break;
         }
 
         return $allResults;
@@ -1498,7 +1499,7 @@ class gitlabModel extends model
             $results = json_decode(commonModel::http($url . "&&page={$page}&per_page=100"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
-            if(count($results)<100) break;
+            if(count($results) < 100) break;
         }
 
         return $allResults;
@@ -1537,7 +1538,7 @@ class gitlabModel extends model
                 $results = json_decode(commonModel::http($url . "&&page={$page}&per_page=100"));
                 if(!is_array($results)) break;
                 if(!empty($results)) $allResults = array_merge($allResults, $results);
-                if(count($results)<100) break;
+                if(count($results) < 100) break;
             }
 
             return $allResults;
@@ -1595,7 +1596,7 @@ class gitlabModel extends model
             $results = json_decode(commonModel::http($url . "&&page={$page}&per_page=100"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
-            if(count($results)<100) break;
+            if(count($results) < 100) break;
         }
 
         $tags = array();
@@ -2775,6 +2776,7 @@ class gitlabModel extends model
         $accessLevel = $this->config->gitlab->accessLevel[$maxRole];
 
         if(isset($project->permissions->project_access->access_level) and $project->permissions->project_access->access_level >= $accessLevel) return true;
+        if(isset($project->permissions->group_access->access_level) and $project->permissions->group_access->access_level >= $accessLevel) return true;
         if(!empty($project->shared_with_groups))
         {
             if(empty($groupIDList))
diff --git a/module/job/model.php b/module/job/model.php
index d679f7400e..c1387806d6 100644
--- a/module/job/model.php
+++ b/module/job/model.php
@@ -322,9 +322,9 @@ class jobModel extends model
         if(!empty($job->projectKey) and $job->frame == 'sonarqube')
         {
             $projectList = $this->getJobBySonarqubeProject($job->sonarqubeServer, array($job->projectKey));
-            if(!empty($projectList) && $projectList[$job->projectKey]->id != $id)
+            if(!empty($projectList) && $projectList[$job->projectKey] != $id)
             {
-                $message = sprintf($this->lang->job->projectExists, $projectList[$job->projectKey]->id);
+                $message = sprintf($this->lang->job->projectExists, $projectList[$job->projectKey]);
                 dao::$errors[]['projectKey'] = $message;
                 return false;
             }
diff --git a/module/mr/control.php b/module/mr/control.php
index d2a46cb692..e682c0e78a 100644
--- a/module/mr/control.php
+++ b/module/mr/control.php
@@ -82,12 +82,19 @@ class mr extends control
             return $this->send($result);
         }
 
+        $gitlabHosts = $this->loadModel('gitlab')->getPairs();
+        $gitlabUsers = $this->gitlab->getGitLabListByAccount();
+        foreach($gitlabHosts as $gitlabID=> $gitlabHost)
+        {
+            if(!$this->app->user->admin and !isset($gitlabUsers[$gitlabID])) unset($gitlabHosts[$gitlabID]);
+        }
+
         $this->app->loadLang('repo'); /* Import lang in repo module. */
         $this->app->loadLang('compile');
         $this->view->title       = $this->lang->mr->create;
         $this->view->users       = $this->loadModel('user')->getPairs('noletter|noclosed');
         $this->view->jobList     = $this->loadModel('job')->getList();
-        $this->view->gitlabHosts = $this->loadModel('gitlab')->getPairs();
+        $this->view->gitlabHosts = $gitlabHosts;
         $this->display();
     }
 
@@ -152,6 +159,18 @@ class mr extends control
 
         $gitlabUsers = $this->gitlab->getUserAccountIdPairs($MR->gitlabID);
 
+        /* Check permissions. */
+        if(!$this->app->user->admin)
+        {
+            $groupIDList = array(0 => 0);
+            $groups      = $this->gitlab->apiGetGroups($MR->gitlabID, 'name_asc', $this->config->gitlab->accessLevel['developer']);
+            foreach($groups as $group) $groupIDList[] = $group->id;
+            $sourceProject = $this->gitlab->apiGetSingleProject($MR->gitlabID, $MR->sourceProject);
+            $isDeveloper   = $this->gitlab->checkUserAccess($MR->gitlabID, 0, $sourceProject, $groupIDList, 'developer');
+
+            if(!isset($gitlabUsers[$this->app->user->account]) or !$isDeveloper) return print(js::alert($this->lang->mr->errorLang[3]) . js::locate($this->createLink('mr', 'browse')));
+        }
+
         /* Import lang for required modules. */
         $this->loadModel('repo');
         $this->loadModel('job');
diff --git a/module/mr/js/create.js b/module/mr/js/create.js
index 6414507f6c..00a0d02d22 100644
--- a/module/mr/js/create.js
+++ b/module/mr/js/create.js
@@ -5,7 +5,7 @@ $(function()
         var gitlabID = $('#gitlabID').val();
         if(gitlabID == '') return false;
 
-        var url = createLink('repo', 'ajaxgetgitlabprojects', "gitlabID=" + gitlabID);
+        var url = createLink('repo', 'ajaxgetgitlabprojects', "gitlabID=" + gitlabID + "&projectIdList=&filter=IS_DEVELOPER");
         $.get(url, function(response)
         {
             $('#sourceProject').html('').append(response);
diff --git a/module/mr/model.php b/module/mr/model.php
index ed7f87cf73..b80c8eaa4b 100644
--- a/module/mr/model.php
+++ b/module/mr/model.php
@@ -94,7 +94,7 @@ class mrModel extends model
     }
 
     /**
-     * Get all gitlab server project,private projects that do not include guest permissions.
+     * Get all gitlab server projects. If not an administrator, the role of project member should be higher than guest.
      *
      * @access public
      * @return array
@@ -106,14 +106,17 @@ class mrModel extends model
             ->fetchPairs('gitlabID');
 
         $allProjects = array();
-        $gitlabUsers = $this->dao->select('providerID,openID')->from(TABLE_OAUTH)
-            ->where('providerType')->eq('gitlab')
-            ->andWhere('account')->eq($this->app->user->account)
-            ->fetchPairs();
+        $allGroups   = array();
+        $gitlabUsers = $this->gitlab->getGitLabListByAccount();
         foreach($gitlabIDList as $gitlabID)
         {
             if(!$this->app->user->admin and !isset($gitlabUsers[$gitlabID])) continue;
-            $allProjects[$gitlabID] = $this->gitlab->apiGetProjects($gitlabID);
+
+            $allProjects[$gitlabID] = $this->gitlab->apiGetProjects($gitlabID, 'false');
+            $groupIDList = array(0 => 0);
+            $groups      = $this->gitlab->apiGetGroups($gitlabID, 'name_asc', $this->config->gitlab->accessLevel['reporter']);
+            foreach($groups as $group) $groupIDList[] = $group->id;
+            $allGroups[$gitlabID] = $groupIDList;
         }
 
         $allProjectPairs = array();
@@ -121,7 +124,7 @@ class mrModel extends model
         {
             foreach($projects as $key => $project)
             {
-                if(empty($project->permissions->project_access->access_level) or $project->permissions->project_access->access_level <= 10) continue;
+                if($this->gitlab->checkUserAccess($gitlabID, 0, $project, $allGroups[$gitlabID], 'reporter') == false) continue;
                 $allProjectPairs[$gitlabID][$project->id] = $project;
             }
         }
diff --git a/module/repo/control.php b/module/repo/control.php
index 69b894b215..2ecf5050c0 100644
--- a/module/repo/control.php
+++ b/module/repo/control.php
@@ -1133,9 +1133,30 @@ class repo extends control
      * @access public
      * @return void
      */
-    public function ajaxGetGitlabProjects($gitlabID, $projectIdList = '')
+    public function ajaxGetGitlabProjects($gitlabID, $projectIdList = '', $filter = '')
     {
-        $projects = $this->loadModel('gitlab')->apiGetProjects($gitlabID);
+        if($this->app->user->admin)
+        {
+            $projects = $this->loadModel('gitlab')->apiGetProjects($gitlabID);
+        }
+        else
+        {
+            $gitlabUser = $this->loadModel('gitlab')->getUserIDByZentaoAccount($gitlabID, $this->app->user->account);
+            if(!$gitlabUser) $this->send(array('message' => array()));
+
+            $projects    = $this->gitlab->apiGetProjects($gitlabID, $filter ? 'false' : 'true');
+            $groupIDList = array(0 => 0);
+            $groups      = $this->gitlab->apiGetGroups($gitlabID, 'name_asc', $this->config->gitlab->accessLevel['developer']);
+            foreach($groups as $group) $groupIDList[] = $group->id;
+            if($filter == 'IS_DEVELOPER')
+            {
+                foreach($projects as $key => $project)
+                {
+                    if($this->gitlab->checkUserAccess($gitlabID, 0, $project, $groupIDList, 'developer') == false) unset($projects[$key]);
+                }
+            }
+        }
+
 
         if(!$projects) $this->send(array('message' => array()));
         $projectIdList = $projectIdList ? explode(',', $projectIdList) : null;