From fee9d605a353ad34487c0c353a73473b325d52fa Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Fri, 8 Apr 2011 12:21:06 +0000
Subject: [PATCH] Adds visibility condition to Issue.by_* count methods.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@5365 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/models/issue.rb     | 27 ++++++++++++++-------------
 test/unit/issue_test.rb | 12 ++++++++++--
 2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/app/models/issue.rb b/app/models/issue.rb
index 943626686..aca68b1ae 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -647,14 +647,16 @@ class Issue < ActiveRecord::Base
   def self.by_subproject(project)
     ActiveRecord::Base.connection.select_all("select    s.id as status_id, 
                                                 s.is_closed as closed, 
-                                                i.project_id as project_id,
-                                                count(i.id) as total 
+                                                #{Issue.table_name}.project_id as project_id,
+                                                count(#{Issue.table_name}.id) as total 
                                               from 
-                                                #{Issue.table_name} i, #{IssueStatus.table_name} s
+                                                #{Issue.table_name}, #{Project.table_name}, #{IssueStatus.table_name} s
                                               where 
-                                                i.status_id=s.id 
-                                                and i.project_id IN (#{project.descendants.active.collect{|p| p.id}.join(',')})
-                                              group by s.id, s.is_closed, i.project_id") if project.descendants.active.any?
+                                                #{Issue.table_name}.status_id=s.id
+                                                and #{Issue.table_name}.project_id = #{Project.table_name}.id
+                                                and #{visible_condition(User.current, :project => project, :with_subprojects => true)}
+                                                and #{Issue.table_name}.project_id <> #{project.id}
+                                              group by s.id, s.is_closed, #{Issue.table_name}.project_id") if project.descendants.active.any?
   end
   # End ReportsController extraction
   
@@ -864,20 +866,19 @@ class Issue < ActiveRecord::Base
     select_field = options.delete(:field)
     joins = options.delete(:joins)
 
-    where = "i.#{select_field}=j.id"
+    where = "#{Issue.table_name}.#{select_field}=j.id"
     
     ActiveRecord::Base.connection.select_all("select    s.id as status_id, 
                                                 s.is_closed as closed, 
                                                 j.id as #{select_field},
-                                                count(i.id) as total 
+                                                count(#{Issue.table_name}.id) as total 
                                               from 
-                                                  #{Issue.table_name} i, #{IssueStatus.table_name} s, #{joins} j
+                                                  #{Issue.table_name}, #{Project.table_name}, #{IssueStatus.table_name} s, #{joins} j
                                               where 
-                                                i.status_id=s.id 
+                                                #{Issue.table_name}.status_id=s.id 
                                                 and #{where}
-                                                and i.project_id=#{project.id}
+                                                and #{Issue.table_name}.project_id=#{Project.table_name}.id
+                                                and #{visible_condition(User.current, :project => project)}
                                               group by s.id, s.is_closed, j.id")
   end
-  
-
 end
diff --git a/test/unit/issue_test.rb b/test/unit/issue_test.rb
index 5f61d61a5..d12eb2205 100644
--- a/test/unit/issue_test.rb
+++ b/test/unit/issue_test.rb
@@ -788,45 +788,53 @@ class IssueTest < ActiveSupport::TestCase
   end
 
   test "#by_tracker" do
+    User.current = User.anonymous
     groups = Issue.by_tracker(Project.find(1))
     assert_equal 3, groups.size
     assert_equal 7, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
 
   test "#by_version" do
+    User.current = User.anonymous
     groups = Issue.by_version(Project.find(1))
     assert_equal 3, groups.size
     assert_equal 3, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
 
   test "#by_priority" do
+    User.current = User.anonymous
     groups = Issue.by_priority(Project.find(1))
     assert_equal 4, groups.size
     assert_equal 7, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
 
   test "#by_category" do
+    User.current = User.anonymous
     groups = Issue.by_category(Project.find(1))
     assert_equal 2, groups.size
     assert_equal 3, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
 
   test "#by_assigned_to" do
+    User.current = User.anonymous
     groups = Issue.by_assigned_to(Project.find(1))
     assert_equal 2, groups.size
     assert_equal 2, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
 
   test "#by_author" do
+    User.current = User.anonymous
     groups = Issue.by_author(Project.find(1))
     assert_equal 4, groups.size
     assert_equal 7, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
 
   test "#by_subproject" do
+    User.current = User.anonymous
     groups = Issue.by_subproject(Project.find(1))
-    assert_equal 2, groups.size
-    assert_equal 5, groups.inject(0) {|sum, group| sum + group['total'].to_i}
+    # Private descendant not visible
+    assert_equal 1, groups.size
+    assert_equal 2, groups.inject(0) {|sum, group| sum + group['total'].to_i}
   end
   
   
-- 
2.39.5