Resolution: Won't Fix
Affects Version/s: 4.6.2
Fix Version/s: 4.6.3
1. Because contribution receipts and event confirmation emails are 'public' (non-authenticated displays), we should exclude groups with 'User and User Admin Only' visibility from Group(s) profile field output on contribution receipts and event confirmation emails.
Here's how to reproduce the current behavior:
a. add "group(s)" as a field in a profile used on a contribution page
b. note that only public groups appear on the profile as webpage (correctly)
c. find a contact and add that contact to several groups, both public and "User and User Admin Only" (e.g. 2 "User and User Admin Only" groups and 1 public group)
d. as that contact, make a contribution on the page from step #1
e. in the receipt note that ALL the groups including "User and User Admin Only" are shown, not just public groups (incorrectly)
2. 'User and User Admin' visibility groups are ALSO currently shown in Group(s) listing on profile/view page for ANY authenticated user. These should only be displayed if the authenticated user has 'access CiviCRM' and 'view contact' permission for that contact. If user is viewing their own record then 'view my contact' is sufficient.
3. Verify (or fix) that these groups also are NOT shown on confirmation and thank-you pages UNLESS the authenticated user has 'access CiviCRM' and 'view contact' permission for that contact.
4. Fix the WARNING in profile/view:
Warning: in_array() expects parameter 2 to be array, null given in CRM_ACL_API::groupPermission() (line 230 of /Users/dgg/git/crm_v4.6/CRM/ACL/API.php)