When selecting the Source tab for a project where the user does not have permissions, an error page should be displayed, rather that a 403 error page.

It's Jetty's 403 page, which Fisheye doesn't override - see WEB-INF/web.xml:

<error-page>
<error-code>404</error-code>
<location>/404.jsp</location>
</error-page>
<error-page>
<error-code>500</error-code>
<location>/500.jsp</location>
</error-page>

See - https://studio.atlassian.com/browse/JST-860