Profile search with smart group intermittently returns no results for anon without view all contacts permission

See http://forum.civicrm.org/index.php/topic,6375.0.html

Use case: profile search to allow anonymous users to search a public directory of organizations, showing a subset of fields (some custom) for a subset of the orgs in the Civi db.

Implemented using profile restricted to smart group, which specifies the subset of searchable contacts.

This has been working intermittently with the following permissions set for anon: profile listings and forms, access all custom data. On some trials the search would return no results for anon.

I have found a reliable way to replicate this on a quiet sandbox running Civi 2.1.4, with "view all contacts" perm not granted to anon and with a profile search restricted to a smart group:

• As privileged user, edit a contact (a null change will do) - this empties civicrm_group_contact_cache.
• Check cache: SELECT group_id, COUNT FROM civicrm_group_contact_cache GROUP BY group_id ==> empty.
• As anon user, submit profile search ==> "No matches found for: Member of Group IN".

However the following works with "view all contacts" perm granted to anon:

• As privileged user, edit a contact.
• Check cache: SELECT group_id, COUNT FROM civicrm_group_contact_cache GROUP BY group_id ==> empty.
• As anon user, submit profile search ==> search works.
• Check cache: SELECT group_id, COUNT FROM civicrm_group_contact_cache GROUP BY group_id ==> not empty.

I'm guessing the code that causes CRM_Contact_BAO_GroupContactCache::load to be called is bypassed if the user lacks "view all contacts" perm, but should be executed provided user has "profile listings and forms". A workaround is to enable "view all contacts" for anon.

Quote from: Donald Lobo on January 30, 2009, 08:05:49 pm
there is a smart group cache which I suspect has at least one bug which we have not been able to track/reproduce. There is an attempted workaround in 2.1.4 for this. This bug might explain "the search would return no results for anon"

I found this issue: CRM-3729, Smart group searches are unreliable when lots of data entry activity is going on. This introduced "Smart group cache timeout" and is in 2.2 but not 2.1.4, so perhaps this is a different change from the one Lobo refers to above. It will doubtless affect the observed behaviour: I imagine it could reduce the probability of the problem occurring without eliminating it. I'd suggest (but I'm not knowledgeable on Civi internals):

(1) Check that the code that causes GroupContactCache to be loaded has the right logic for anon user with "profile listings and forms" perm but without "view all contacts".
(2) Test using above steps; if the "Smart group cache timeout" code means that the cache is not empty after the contact edit, find another way to empty it.

Dave J