Stastics API should handle group members

statistic API use security Context to list project rather than calling
projectmanager directly, such that the group membership will be taken
into account.
fixes #10230

It should be cherry picked to 1.9.x and 1.10.x branches

Signed-off-by: Daniel Jiang <jiangd@vmware.com>

src/core/api/statistic.go

@@ -67,7 +67,7 @@ func (s *StatisticAPI) Get() {
 	if len(pubProjs) == 0 {
 		statistic[PubRC] = 0
 	} else {
-		ids := []int64{}
+		ids := make([]int64, 0)
 		for _, p := range pubProjs {
 			ids = append(ids, p.ProjectID)
 		}
@@ -101,30 +101,26 @@ func (s *StatisticAPI) Get() {
 		statistic[TRC] = n
 		statistic[PriRC] = n - statistic[PubRC]
 	} else {
-		value := false
+		// including the public ones
-		result, err := s.ProjectMgr.List(&models.ProjectQueryParam{
+		myProjects, err := s.SecurityCtx.GetMyProjects()
-			Public: &value,
+		privProjectIDs := make([]int64, 0)
-			Member: &models.MemberQuery{
-				Name: s.username,
-			},
-		})
 		if err != nil {
 			s.ParseAndHandleError(fmt.Sprintf(
 				"failed to get projects of user %s", s.username), err)
 			return
 		}
+		for _, p := range myProjects {
+			if !p.IsPublic() {
+				privProjectIDs = append(privProjectIDs, p.ProjectID)
+			}
+		}
 
-		statistic[PriPC] = result.Total
+		statistic[PriPC] = int64(len(privProjectIDs))
-		if result.Total == 0 {
+		if statistic[PriPC] == 0 {
 			statistic[PriRC] = 0
 		} else {
-			ids := []int64{}
-			for _, p := range result.Projects {
-				ids = append(ids, p.ProjectID)
-			}
-
 			n, err := dao.GetTotalOfRepositories(&models.RepositoryQuery{
-				ProjectIDs: ids,
+				ProjectIDs: privProjectIDs,
 			})
 			if err != nil {
 				s.SendInternalServerError(fmt.Errorf(