Return 403 if user can't update group

app/controllers/projects/group_links_controller.rb

@@ -21,6 +21,7 @@ class Projects::GroupLinksController < Projects::ApplicationController
 
   def update
     @group_link = @project.project_group_links.find(params[:id])
+    return render_403 unless can?(current_user, action_member_permission(:admin, @group_link.group), @group_link.group)
 
     @group_link.update_attributes(group_link_params)
   end