Use of aclGroup hook causes permissioned groups not to show

ACL hook causes manage group to display incorrect list of groups for users who have groups edited by the ACL hook.

This isn't a regression bug but I have now debugged why & where it is happening.

CRM_Contact_BAO::getGroupList

&&

CRM_Contact_BAO::getGroupCount

both call

CRM_ContactBAO::whereClause

to generate their where clause. This function does not call the aclGroup hook and includes all groups otherwise possible. After that getGroupList (but not getGroupCount) filters the list down via the aclGroup function.

As getGroupList applies a limit of 25 it only retrieves 25 results & the removes the ones that are not permitted. In an extreme example which I have on client site none of the first 25 are viewable by the person and hence no groups at all are presented to them.

More commonly it shows less than the 25 on the first page and they can scroll to the next page for more. The number of groups is always wrong.

At this stage I think the safest / easiest option is to add a second hook

aclGroupWhere which allows the function to modify the query @ the where clause - obvious module writers would need to implement this before it would work...