Ajax permissions

[Eileen]

Hi,

This is hard to test on the demo site due to not having the right users in place. This is on my  2.2b4 install

I have a user on who has been set to only be allowed to view one group of contacts and one group of organisations. When I use the ajax search boxes my user can see many more names (although they can't find them in an actual search). Likewise when they access the employer search box (e.g. edit user) they can see employers that they don't have rights to view.

I note the function in ajax to get the employer list is actually called     

static function getPermissionedEmployer( $contactID, $name = '%' )

which implies it is checking permissions but my experience is that it isn't