From 35239a0de6afce5a7c5dfc4bec42330725146fdb Mon Sep 17 00:00:00 2001
From: Gregor Schmidt <schmidt@nach-vorne.eu>
Date: Fri, 30 Nov 2018 14:37:38 +0100
Subject: [PATCH] Limit total_estimated_hours to visible issues

---
 app/models/issue.rb                |  2 +-
 app/models/issue_query.rb          |  4 ++--
 test/unit/issue_subtasking_test.rb |  5 ++++-
 test/unit/query_test.rb            | 33 ++++++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/app/models/issue.rb b/app/models/issue.rb
index b20da8d91..efd2789ed 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -1073,7 +1073,7 @@ class Issue < ActiveRecord::Base
     if leaf?
       estimated_hours
     else
-      @total_estimated_hours ||= self_and_descendants.sum(:estimated_hours)
+      @total_estimated_hours ||= self_and_descendants.visible.sum(:estimated_hours)
     end
   end
 
diff --git a/app/models/issue_query.rb b/app/models/issue_query.rb
index 9b9b87cc9..c07286dc3 100644
--- a/app/models/issue_query.rb
+++ b/app/models/issue_query.rb
@@ -37,8 +37,8 @@ class IssueQuery < Query
     QueryColumn.new(:due_date, :sortable => "#{Issue.table_name}.due_date"),
     QueryColumn.new(:estimated_hours, :sortable => "#{Issue.table_name}.estimated_hours", :totalable => true),
     QueryColumn.new(:total_estimated_hours,
-      :sortable => "COALESCE((SELECT SUM(estimated_hours) FROM #{Issue.table_name} subtasks" +
-        " WHERE subtasks.root_id = #{Issue.table_name}.root_id AND subtasks.lft >= #{Issue.table_name}.lft AND subtasks.rgt <= #{Issue.table_name}.rgt), 0)",
+      :sortable => -> { "COALESCE((SELECT SUM(estimated_hours) FROM #{Issue.table_name} subtasks" +
+        " WHERE #{Issue.visible_condition(User.current).gsub(/\bissues\b/, 'subtasks')} AND subtasks.root_id = #{Issue.table_name}.root_id AND subtasks.lft >= #{Issue.table_name}.lft AND subtasks.rgt <= #{Issue.table_name}.rgt), 0)" },
       :default_order => 'desc'),
     QueryColumn.new(:done_ratio, :sortable => "#{Issue.table_name}.done_ratio", :groupable => true),
     QueryColumn.new(:created_on, :sortable => "#{Issue.table_name}.created_on", :default_order => 'desc'),
diff --git a/test/unit/issue_subtasking_test.rb b/test/unit/issue_subtasking_test.rb
index 00d64a052..c54586d70 100644
--- a/test/unit/issue_subtasking_test.rb
+++ b/test/unit/issue_subtasking_test.rb
@@ -332,7 +332,7 @@ class IssueSubtaskingTest < ActiveSupport::TestCase
     end
   end
 
-  def test_parent_total_estimated_hours_should_be_sum_of_descendants
+  def test_parent_total_estimated_hours_should_be_sum_of_visible_descendants
     parent = Issue.generate!
     parent.generate_child!(:estimated_hours => nil)
     assert_equal 0, parent.reload.total_estimated_hours
@@ -340,6 +340,9 @@ class IssueSubtaskingTest < ActiveSupport::TestCase
     assert_equal 5, parent.reload.total_estimated_hours
     parent.generate_child!(:estimated_hours => 7)
     assert_equal 12, parent.reload.total_estimated_hours
+
+    parent.generate_child!(:estimated_hours => 9, :is_private => true)
+    assert_equal 12, parent.reload.total_estimated_hours
   end
 
   def test_open_issue_with_closed_parent_should_not_validate
diff --git a/test/unit/query_test.rb b/test/unit/query_test.rb
index e868ef456..1bb50a13b 100644
--- a/test/unit/query_test.rb
+++ b/test/unit/query_test.rb
@@ -1558,6 +1558,39 @@ class QueryTest < ActiveSupport::TestCase
     assert_equal values.sort, values
   end
 
+  def test_sort_by_total_for_estimated_hours
+    # Prepare issues
+    parent = issues(:issues_001)
+    child = issues(:issues_002)
+    private_child = issues(:issues_003)
+    other = issues(:issues_007)
+
+    User.current = users(:users_001)
+
+    parent.safe_attributes         = {:estimated_hours => 1}
+    child.safe_attributes          = {:estimated_hours => 2, :parent_issue_id => 1}
+    private_child.safe_attributes  = {:estimated_hours => 4, :parent_issue_id => 1, :is_private => true}
+    other.safe_attributes          = {:estimated_hours => 5}
+
+    [parent, child, private_child, other].each(&:save!)
+
+
+    q = IssueQuery.new(
+      :name => '_',
+      :filters => { 'issue_id' => {:operator => '=', :values => ['1,7']} },
+      :sort_criteria => [['total_estimated_hours', 'asc']]
+    )
+
+    # With private_child, `parent' is "bigger" than `other'
+    ids = q.issue_ids
+    assert_equal [7, 1], ids, "Private issue was not used to calculate sort order"
+
+    # Without the invisible private_child, `other' is "bigger" than `parent'
+    User.current = User.anonymous
+    ids = q.issue_ids
+    assert_equal [1, 7], ids, "Private issue was used to calculate sort order"
+  end
+
   def test_set_totalable_names
     q = IssueQuery.new
     q.totalable_names = ['estimated_hours', :spent_hours, '']
-- 
2.19.1