We recently started using ACLs to fine-tune access to custom fields. Roughly speaking, our setup is:
- all authenticated users can access custom field group 1
- role 1 can access field groups 2, 3, 4
- role 2 can access field group 5
The problem is that once in a while, a user with role 1 can't see fields in groups 2, 3 and 4 when looking at a contact's summary page. Refreshing the page fixes the issue.
Unfortunately, if we are using memcache, refreshing no longer helps (which makes sense).
What would cause Civi to not correctly check ACL permissions once but then work on the second attempt? Of course this appears to happen completely randomly and is impossible to recreate consistently.
Running CiviCRM 4.6.2.
UPDATE: Issues appear to start during Drupal's cron run.
/CRM/ACL/BAO/ACL.php:group() returns erratic and inconsistent arrays of custom field group IDs every time it gets called. Seems like drupal's cron wreaks some sort of havoc on the acl cache and civi has a hard time rebuilding it.