diff --git a/module/gitlab/control.php b/module/gitlab/control.php
index 6d2808fd1f..942567f049 100644
--- a/module/gitlab/control.php
+++ b/module/gitlab/control.php
@@ -256,10 +256,10 @@ class gitlab extends control
         if(strpos($gitlab->url, 'http') !== 0) return $this->send(array('result' => 'fail', 'message' => array('url' => array(sprintf($this->lang->gitlab->hostError, $this->config->gitlab->minCompatibleVersion)))));
         if(!$gitlab->token) return $this->send(array('result' => 'fail', 'message' => array('token' => array($this->lang->gitlab->tokenError))));
 
-        $user = $this->gitlab->apiGetCurrentUser($gitlab->url, $gitlab->token);
+        $user = $this->gitlab->checkTokenAccess($gitlab->url, $gitlab->token);
 
-        if(!is_object($user)) return $this->send(array('result' => 'fail', 'message' => array('url' => array(sprintf($this->lang->gitlab->hostError, $this->config->gitlab->minCompatibleVersion)))));
-        if(!isset($user->id) or !isset($user->is_admin) or !$user->is_admin) return $this->send(array('result' => 'fail', 'message' => array('token' => array($this->lang->gitlab->tokenError))));
+        if(is_bool($user)) return $this->send(array('result' => 'fail', 'message' => array('url' => array(sprintf($this->lang->gitlab->hostError, $this->config->gitlab->minCompatibleVersion)))));
+        if(!isset($user->id)) return $this->send(array('result' => 'fail', 'message' => array('token' => array($this->lang->gitlab->tokenError))));
 
         /* Verify version compatibility. */
         $result = $this->gitlab->getVersion($gitlab->url, $gitlab->token);
diff --git a/module/gitlab/model.php b/module/gitlab/model.php
index 9d7c3c2028..65f147a955 100644
--- a/module/gitlab/model.php
+++ b/module/gitlab/model.php
@@ -2833,4 +2833,25 @@ class gitlabModel extends model
         $host = rtrim($host, '/') . "/api/v4%s?private_token=$token";
         return $this->apiGet($host, '/version');
     }
+
+    /**
+     * Check token access.
+     *
+     * @param  string $url
+     * @param  string $token
+     * @access public
+     * @return void
+     */
+    public function checkTokenAccess($url = '', $token = '')
+    {
+        $apiRoot  = rtrim($url, '/') . '/api/v4%s' . "?private_token={$token}";
+        $url      = sprintf($apiRoot, "/users") . "&per_page=5&active=true";
+        $httpData = commonModel::httpWithHeader($url);
+        $users    = json_decode($httpData['body']);
+        if(empty($users)) return false;
+        if(isset($users->message) or isset($users->error)) return null;
+
+        $apiRoot .= '&sudo=' . $users[0]->id;
+        return $this->apiGet($apiRoot, '/user');
+    }
 }
diff --git a/module/repo/js/create.js b/module/repo/js/create.js
index fc45001f45..a5ad8b9a92 100644
--- a/module/repo/js/create.js
+++ b/module/repo/js/create.js
@@ -26,7 +26,7 @@ $(function()
     $('#gitlabHost').change(function()
     {
         host  = $('#gitlabHost').val();
-        url   = createLink('repo', 'ajaxgetgitlabprojects', "host=" + host + "&projectIdList=&filter=ALL");
+        url   = createLink('repo', 'ajaxGetGitlabProjects', "host=" + host);
         if(host == '') return false;
 
         $.get(url, function(response)
diff --git a/test/model/gitlab/apigetcurrentuser.php b/test/model/gitlab/apigetcurrentuser.php
index 608c116a70..2a1b985121 100644
--- a/test/model/gitlab/apigetcurrentuser.php
+++ b/test/model/gitlab/apigetcurrentuser.php
@@ -19,12 +19,12 @@ $result = $gitlab->apiGetCurrentUser($host, $token);
 if($result === false) $result = 'return false';
 r($result) && p() && e('return false'); //使用空的数据获取用户信息
 
-$host   = 'http://192.168.1.161:5108';
+$host   = 'http://10.0.1.161:5108';
 $result = $gitlab->apiGetCurrentUser($host, $token);
 if(!$result) $result = 'return null';
 r($result) && p() && e('return null'); //使用错误的host获取用户信息
 
-$host   = 'http://192.168.1.161:51080';
+$host   = 'http://10.0.1.161:51080';
 $result = $gitlab->apiGetCurrentUser($host, $token);
 r($gitlab->apiGetCurrentUser($host, $token)) && p('message') && e('401 Unauthorized'); //使用正确的host,错误的token获取用户信息
 
diff --git a/test/model/gitlab/checktokenaccess.php b/test/model/gitlab/checktokenaccess.php
new file mode 100644
index 0000000000..0a65a35396
--- /dev/null
+++ b/test/model/gitlab/checktokenaccess.php
@@ -0,0 +1,40 @@
+#!/usr/bin/env php
+<?php
+include dirname(dirname(dirname(__FILE__))) . '/lib/init.php';
+
+/**
+
+title=测试 gitlabModel::checkTokenAccess();
+cid=1
+pid=1
+
+*/
+
+$gitlab = $tester->loadModel('gitlab');
+
+$host      = '';
+$token     = '';
+
+$result = $gitlab->checkTokenAccess($host, $token);
+if($result === false) $result = 'return false';
+r($result) && p() && e('return false'); //使用空的数据验证token权限
+
+$host   = 'http://10.0.1.161:5108';
+$result = $gitlab->checkTokenAccess($host, $token);
+if(!$result) $result = 'return false';
+r($result) && p() && e('return false'); //使用错误的host验证token权限
+
+$host   = 'http://10.0.1.161:51080';
+$result = $gitlab->checkTokenAccess($host, $token);
+if(empty($result)) $result = 'return null';
+r($result) && p() && e('return null'); //使用正确的host,错误的token验证token权限
+
+$token  = 'x88fZokrp5hShia2jyBN';
+$result = $gitlab->checkTokenAccess($host, $token);
+if(isset($result->id)) $result = 'success';
+r($result) && p() && e('success'); //通过host,token验证token权限
+
+$token  = 'wVFHE6NZA-cJy-3U2y2J';
+$result = $gitlab->checkTokenAccess($host, $token);
+if(!isset($result->id)) $result = 'no access';
+r($result) && p() && e('no access'); //通过host,权限不足的token验证token权限