From 56159412b34c1120e5247c119dec5e809084940d 2017-01-29 10:31:04
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: 2017-01-29 10:31:04
Subject: [PATCH] Issues API does not respect time_entries_visibility (#24875).

Patch by Go MAEDA.

git-svn-id: http://svn.redmine.org/redmine/trunk@16293 e93f8b46-1217-0410-a6f0-8f06a7374b81

---

diff --git a/test/integration/api_test/issues_test.rb b/test/integration/api_test/issues_test.rb
index de0a2fd..65bf3be 100644
--- a/test/integration/api_test/issues_test.rb
+++ b/test/integration/api_test/issues_test.rb
@@ -389,6 +389,23 @@ class Redmine::ApiTest::IssuesTest < Redmine::ApiTest::Base
     end
   end
 
+  test "GET /issues/:id.xml should contains visible spent_hours only" do
+    user = User.find_by_login('jsmith')
+    Role.find(1).update(:time_entries_visibility => 'own')
+    parent = Issue.find(3)
+    child = Issue.generate!(:parent_issue_id => parent.id)
+    TimeEntry.generate!(:user => user, :hours => 5.5, :issue_id => parent.id)
+    TimeEntry.generate!(:user => user, :hours => 2, :issue_id => child.id)
+    TimeEntry.generate!(:user => User.find(1), :hours => 100, :issue_id => child.id)
+    get '/issues/3.xml', {} , credentials(user.login)
+
+    assert_equal 'application/xml', response.content_type
+    assert_select 'issue' do
+      assert_select 'spent_hours',           '5.5'
+      assert_select 'total_spent_hours',     '7.5'
+    end
+  end
+
   test "GET /issues/:id.json should contains total_estimated_hours and total_spent_hours" do
     parent = Issue.find(3)
     parent.update_columns :estimated_hours => 2.0
@@ -422,6 +439,22 @@ class Redmine::ApiTest::IssuesTest < Redmine::ApiTest::Base
     assert_nil json['issue']['total_spent_hours']
   end
 
+  test "GET /issues/:id.json should contains visible spent_hours only" do
+    user = User.find_by_login('jsmith')
+    Role.find(1).update(:time_entries_visibility => 'own')
+    parent = Issue.find(3)
+    child = Issue.generate!(:parent_issue_id => parent.id)
+    TimeEntry.generate!(:user => user, :hours => 5.5, :issue_id => parent.id)
+    TimeEntry.generate!(:user => user, :hours => 2, :issue_id => child.id)
+    TimeEntry.generate!(:user => User.find(1), :hours => 100, :issue_id => child.id)
+    get '/issues/3.json', {} , credentials(user.login)
+
+    assert_equal 'application/json', response.content_type
+    json = ActiveSupport::JSON.decode(response.body)
+    assert_equal 5.5, json['issue']['spent_hours']
+    assert_equal 7.5, json['issue']['total_spent_hours']
+  end
+
   test "POST /issues.xml should create an issue with the attributes" do
 
 payload = <<-XML