CiviCRM Community Forums (archive)

Use case: profile search to allow anonymous users to search a public directory of organizations, showing a subset of fields (some custom) for a subset of the orgs in the Civi db.

Implemented using profile restricted to smart group, which specifies the subset of searchable contacts.

This has been working intermittently with the following permissions set for anon: profile listings and forms, access all custom data. I noticed that the smart group name was appearing in the qill for a privileged user but not for anon, however the search was correctly restricted to the smart group. But on some trials - with no changes made in the meantime - the search would return no results for anon.

I tried enabling "view all contacts" perm for anon. This got the search working again and made the smart group name appear in the qill. So my points are:

• To report the flaky behaviour. We have had very similar but more severe flakiness with another Civi 2.1.4 site, where configuring the group in the profile does not affect the search results in any consistent way: removing the group from the profile can be followed by getting restricted results and reinstating it can be followed by getting unrestricted results. Is there some caching going on? Any tips on investigating this?
• To ask whether "view all contacts" perm should be required in this scenario. I expect Civi ACLs could be used instead, but the only public access to Civi on this site is via this profile, which is restricted via the smart group.
  

Dave J

Civi 2.1.4
Drupal 6.6

Thanks Lobo for the response.

1. view all contacts is not  needed when restricting a profile to a set group

Thanks for confirming this.

2. do you have a method to reproduce the below issue with a few hits and tries? how flaky is flaky?
3. can you enable mysql logging.

Have enabled mysql logging on dev server and tried to replicate the problems. I'll separate out the issues for clarity.

Issue (A) - profile's smart group name failing to appear in qill on profile search results for anon when "View all contacts" perm not granted: happens 100% on three different 2.1.4 sites with similar profiles.

Issue (B) - profile search intermittently returning no results for anon: I have seen this on two 2.1.4 sites. On one, it has only happened a few times, I have not been able to replicate it today. On the other it is happening on maybe 1 in 4 trials, with a sticky pattern - it will work for a few in a row, then fail for a few in a row - but today only on the instance of the site that's on a live server, not on the dev version. If I catch it on dev, I'll check the mysql query log. This is huge: nearly a million lines in less than a day, on a dev server. I'm guessing I need to look out for civicrm_group_contact_cache, is that right? Nearly 2000 lines in the log containing that. I'd use the devel module, but AFAIK the problem only occurs for anon.

Issue (C) - configuring the group in the profile does not affect the search results in any consistent way: a colleague had this happen on one 2.1.4 site. Having occurred once, it then happened on numerous subsequent trials. I have not replicated this myself but will keep trying.

4. can u get on irc and show us the issue

I'll see if I can find a way to  replicate issue (B) or (C) reliably, then get in touch.

there is a smart group cache which I suspect has at least one bug which we have not been able to track/reproduce. There is an attempted workaround in 2.1.4 for this. This bug might explain "the search would return no results for anon"

I'm happy to throw in some debug code to try to trap this, if you can let me know what to look for & where.

Cheers, Dave J

Issue A is expected behavior. The user does not have access to view all contacts and hence does not have acccess to view any of the groups. Hence the qill does not display the group name

Thanks for clarifying this.

Issue (B) - profile search intermittently returning no results for anon: I have seen this on two 2.1.4 sites...

I have found a reliable way to replicate this on a quiet sandbox running Civi 2.1.4, with "view all contacts" perm not granted to anon and with a profile search restricted to a smart group:

• As privileged user, edit a contact (a null change will do) - this empties civicrm_group_contact_cache.
• Check cache: SELECT group_id, COUNT(*) FROM civicrm_group_contact_cache GROUP BY group_id ==> empty.
• As anon user, submit profile search ==> "No matches found for: Member of Group IN".

However the following works with "view all contacts" perm granted to anon:

• As privileged user, edit a contact.
• Check cache: SELECT group_id, COUNT(*) FROM civicrm_group_contact_cache GROUP BY group_id ==> empty.
• As anon user, submit profile search ==> search works.
• Check cache: SELECT group_id, COUNT(*) FROM civicrm_group_contact_cache GROUP BY group_id ==> not empty.

I'm guessing the code that causes CRM_Contact_BAO_GroupContactCache::load to be called is bypassed if the user lacks "view all contacts" perm, but should be executed provided user has "profile listings and forms". A workaround is to enable "view all contacts" for anon.

there is a smart group cache which I suspect has at least one bug which we have not been able to track/reproduce. There is an attempted workaround in 2.1.4 for this. This bug might explain "the search would return no results for anon"

I found this issue: Smart group searches are unreliable when lots of data entry activity is going on. This introduced "Smart group cache timeout" and is in 2.2 but not 2.1.4, so perhaps this is a different change. It will doubtless affect the observed behaviour. Shall I file a new issue for the above behaviour, so that new releases can be QA'd against the steps to replicate?

Dave J

nice find

Thanks. 

can you please file an issue. we'll fix it for 2.2 and if trivial also backport to 2.1

Done: CRM-4078 Profile search with smart group intermittently returns no results for anon without view all contacts permission.

Dave J