diff --git a/module/gitlab/config.php b/module/gitlab/config.php
index 9997002e5b..044da832df 100644
--- a/module/gitlab/config.php
+++ b/module/gitlab/config.php
@@ -117,6 +117,7 @@ $config->gitlab->objectTypes['story'] = '需求';
 
 $config->gitlab->accessLevel = array();
 $config->gitlab->accessLevel['guest']      = 10;
+$config->gitlab->accessLevel['reporter']   = 20;
 $config->gitlab->accessLevel['developer']  = 30;
 $config->gitlab->accessLevel['maintainer'] = 40;
 $config->gitlab->accessLevel['owner']      = 50;
diff --git a/module/gitlab/model.php b/module/gitlab/model.php
index 2e78a6f7a4..13c4af1db6 100644
--- a/module/gitlab/model.php
+++ b/module/gitlab/model.php
@@ -669,11 +669,12 @@ class gitlabModel extends model
     /**
      * Get projects of one gitlab.
      *
-     * @param  int $gitlabID
+     * @param  int    $gitlabID
+     * @param  string $simple
      * @access public
      * @return array
      */
-    public function apiGetProjects($gitlabID)
+    public function apiGetProjects($gitlabID, $simple = 'true')
     {
         $apiRoot = $this->getApiRoot($gitlabID);
         if(!$apiRoot) return array();
@@ -683,7 +684,7 @@ class gitlabModel extends model
         $allResults = array();
         for($page = 1; true; $page++)
         {
-            $results = json_decode(commonModel::http($url . "&page={$page}&per_page=100"));
+            $results = json_decode(commonModel::http($url . "&simple={$simple}&page={$page}&per_page=100"));
             if(!is_array($results)) break;
             if(!empty($results)) $allResults = array_merge($allResults, $results);
             if(count($results) < 100 or $page > 10) break;
@@ -2775,6 +2776,7 @@ class gitlabModel extends model
         $accessLevel = $this->config->gitlab->accessLevel[$maxRole];
 
         if(isset($project->permissions->project_access->access_level) and $project->permissions->project_access->access_level >= $accessLevel) return true;
+        if(isset($project->permissions->group_access->access_level) and $project->permissions->group_access->access_level >= $accessLevel) return true;
         if(!empty($project->shared_with_groups))
         {
             if(empty($groupIDList))
diff --git a/module/mr/control.php b/module/mr/control.php
index d2a46cb692..e682c0e78a 100644
--- a/module/mr/control.php
+++ b/module/mr/control.php
@@ -82,12 +82,19 @@ class mr extends control
             return $this->send($result);
         }
 
+        $gitlabHosts = $this->loadModel('gitlab')->getPairs();
+        $gitlabUsers = $this->gitlab->getGitLabListByAccount();
+        foreach($gitlabHosts as $gitlabID=> $gitlabHost)
+        {
+            if(!$this->app->user->admin and !isset($gitlabUsers[$gitlabID])) unset($gitlabHosts[$gitlabID]);
+        }
+
         $this->app->loadLang('repo'); /* Import lang in repo module. */
         $this->app->loadLang('compile');
         $this->view->title       = $this->lang->mr->create;
         $this->view->users       = $this->loadModel('user')->getPairs('noletter|noclosed');
         $this->view->jobList     = $this->loadModel('job')->getList();
-        $this->view->gitlabHosts = $this->loadModel('gitlab')->getPairs();
+        $this->view->gitlabHosts = $gitlabHosts;
         $this->display();
     }
 
@@ -152,6 +159,18 @@ class mr extends control
 
         $gitlabUsers = $this->gitlab->getUserAccountIdPairs($MR->gitlabID);
 
+        /* Check permissions. */
+        if(!$this->app->user->admin)
+        {
+            $groupIDList = array(0 => 0);
+            $groups      = $this->gitlab->apiGetGroups($MR->gitlabID, 'name_asc', $this->config->gitlab->accessLevel['developer']);
+            foreach($groups as $group) $groupIDList[] = $group->id;
+            $sourceProject = $this->gitlab->apiGetSingleProject($MR->gitlabID, $MR->sourceProject);
+            $isDeveloper   = $this->gitlab->checkUserAccess($MR->gitlabID, 0, $sourceProject, $groupIDList, 'developer');
+
+            if(!isset($gitlabUsers[$this->app->user->account]) or !$isDeveloper) return print(js::alert($this->lang->mr->errorLang[3]) . js::locate($this->createLink('mr', 'browse')));
+        }
+
         /* Import lang for required modules. */
         $this->loadModel('repo');
         $this->loadModel('job');
diff --git a/module/mr/js/create.js b/module/mr/js/create.js
index 6414507f6c..00a0d02d22 100644
--- a/module/mr/js/create.js
+++ b/module/mr/js/create.js
@@ -5,7 +5,7 @@ $(function()
         var gitlabID = $('#gitlabID').val();
         if(gitlabID == '') return false;
 
-        var url = createLink('repo', 'ajaxgetgitlabprojects', "gitlabID=" + gitlabID);
+        var url = createLink('repo', 'ajaxgetgitlabprojects', "gitlabID=" + gitlabID + "&projectIdList=&filter=IS_DEVELOPER");
         $.get(url, function(response)
         {
             $('#sourceProject').html('').append(response);
diff --git a/module/mr/model.php b/module/mr/model.php
index ed7f87cf73..b80c8eaa4b 100644
--- a/module/mr/model.php
+++ b/module/mr/model.php
@@ -94,7 +94,7 @@ class mrModel extends model
     }
 
     /**
-     * Get all gitlab server project,private projects that do not include guest permissions.
+     * Get all gitlab server projects. If not an administrator, the role of project member should be higher than guest.
      *
      * @access public
      * @return array
@@ -106,14 +106,17 @@ class mrModel extends model
             ->fetchPairs('gitlabID');
 
         $allProjects = array();
-        $gitlabUsers = $this->dao->select('providerID,openID')->from(TABLE_OAUTH)
-            ->where('providerType')->eq('gitlab')
-            ->andWhere('account')->eq($this->app->user->account)
-            ->fetchPairs();
+        $allGroups   = array();
+        $gitlabUsers = $this->gitlab->getGitLabListByAccount();
         foreach($gitlabIDList as $gitlabID)
         {
             if(!$this->app->user->admin and !isset($gitlabUsers[$gitlabID])) continue;
-            $allProjects[$gitlabID] = $this->gitlab->apiGetProjects($gitlabID);
+
+            $allProjects[$gitlabID] = $this->gitlab->apiGetProjects($gitlabID, 'false');
+            $groupIDList = array(0 => 0);
+            $groups      = $this->gitlab->apiGetGroups($gitlabID, 'name_asc', $this->config->gitlab->accessLevel['reporter']);
+            foreach($groups as $group) $groupIDList[] = $group->id;
+            $allGroups[$gitlabID] = $groupIDList;
         }
 
         $allProjectPairs = array();
@@ -121,7 +124,7 @@ class mrModel extends model
         {
             foreach($projects as $key => $project)
             {
-                if(empty($project->permissions->project_access->access_level) or $project->permissions->project_access->access_level <= 10) continue;
+                if($this->gitlab->checkUserAccess($gitlabID, 0, $project, $allGroups[$gitlabID], 'reporter') == false) continue;
                 $allProjectPairs[$gitlabID][$project->id] = $project;
             }
         }
diff --git a/module/repo/control.php b/module/repo/control.php
index 1b601e3722..d5be3d7c2f 100644
--- a/module/repo/control.php
+++ b/module/repo/control.php
@@ -1123,9 +1123,30 @@ class repo extends control
      * @access public
      * @return void
      */
-    public function ajaxGetGitlabProjects($gitlabID, $projectIdList = '')
+    public function ajaxGetGitlabProjects($gitlabID, $projectIdList = '', $filter = '')
     {
-        $projects = $this->loadModel('gitlab')->apiGetProjects($gitlabID);
+        if($this->app->user->admin)
+        {
+            $projects = $this->loadModel('gitlab')->apiGetProjects($gitlabID);
+        }
+        else
+        {
+            $gitlabUser = $this->loadModel('gitlab')->getUserIDByZentaoAccount($gitlabID, $this->app->user->account);
+            if(!$gitlabUser) $this->send(array('message' => array()));
+
+            $projects    = $this->gitlab->apiGetProjects($gitlabID, $filter ? 'false' : 'true');
+            $groupIDList = array(0 => 0);
+            $groups      = $this->gitlab->apiGetGroups($gitlabID, 'name_asc', $this->config->gitlab->accessLevel['developer']);
+            foreach($groups as $group) $groupIDList[] = $group->id;
+            if($filter == 'IS_DEVELOPER')
+            {
+                foreach($projects as $key => $project)
+                {
+                    if($this->gitlab->checkUserAccess($gitlabID, 0, $project, $groupIDList, 'developer') == false) unset($projects[$key]);
+                }
+            }
+        }
+
 
         if(!$projects) $this->send(array('message' => array()));
         $projectIdList = $projectIdList ? explode(',', $projectIdList) : null;