Answers.Body: <p>I can confirm the warning on a vanilla CiviCRM install. Creating an ACL for the mailing list group(s) fixes it, but that doesn't seem right because:</p>
  
  <blockquote>
    <p>The anonymous role (public in Joomla!) applies to all visitors to the
    website who have not logged in. This role will have the lowest level
    of permissions. The default CiviCRM permissions for this role are
    [...] subscribe and unsubscribe from mailing lists
    <a href="https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/" rel="nofollow noreferrer">https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/</a></p>
  </blockquote>
  
  <p>So in principle this shouldn't be necessary.</p>
  
  <p>The problem actually lies in the <code>CRM_ACL_BAO_ACL::group()</code> method because the cache returns <code>NULL</code> rather than an empty array. This then gets passed back unchecked to <code>CRM_ACL_API::groupPermission()</code> where the warning is issued.</p>
  
  <p>Two options for you then:</p>
  
  <ul>
  <li>Raise an issue on Jira and get the problem fixed</li>
  <li>Suppress warnings and write them to a log file instead</li>
  </ul>
  
  <p>Doing both would be the responsible way to go :-)</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-08T19:15:15.710Z
Answers.Text: Thanks, Christian, for confirming. Have already done the 2nd suggestion and will raise the issue in Jira for the long-term resolution. Will also change the original problem to indicate the problem was with Anonymous users only.
Answers.UserDisplayName: ChaosBuster
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-12T14:40:52.723Z
Answers.Text: @ChaosBuster Post the link to the Jira issue and I can help resolve it.
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-12T16:31:35.410Z
Answers.Text: Hmm, I did last week...let me recheck to see.  It should have the same title with 'Anonymous user only' addition.
Answers.UserDisplayName: ChaosBuster
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-12T16:35:11.880Z
Answers.Text: Here it is: https://issues.civicrm.org/jira/browse/CRM-21757
Answers.UserDisplayName: ChaosBuster
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-12T16:44:44.770Z
Answers.Text: Let me know if there are parameters that I did not 'chose wisely' for it to be found or assigned.  ;-)
Answers.UserDisplayName: ChaosBuster
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-14T13:52:40.663Z
Answers.Text: @ChaosBuster Seems this has already been fixed in 4.7.27+. See https://github.com/civicrm/civicrm-core/blame/master/CRM/ACL/BAO/ACL.php#L884
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-15T16:43:41.977Z
Answers.Text: Awesome.  I will look into updating.  Had some updates this weekend to do so will see what impact it will be to just update CiviCRM too.  Thank you for your time and follow through, Christian!
Answers.UserDisplayName: ChaosBuster
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-16T04:12:06.937Z
Answers.Text: Was able to get some time today and do the update from 4.7.29 to 4.7.30 and confirm that it is fixed.  Thank you!
Answers.UserDisplayName: ChaosBuster
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-02-07T12:49:52.620Z
Answers.LastActivityDate: 2018-02-07T12:49:52.620Z
Answers.UserDisplayName: Christian Wach
Body: <p>Hoping the CiviCRM expertise here within stackexchange can provide some guidance on a warning I'm seeing...</p>
  
  <p>When an Anonymous individual on our WordPress CiviCRM site has a Group (Mailing List) selected in a Profile they are shown the following Warning message.  Each Warning message is shown twice for each Group selected by the user. </p>
  
  <p><strong><em>Warning:</strong> in_array() expects parameter 2 to be array, null given in /home/coloradomaker/www/www/wp-content/plugins/civicrm/civicrm/CRM/ACL/API.php on line 218</em></p>
  
  <p>Line 218 is the return statement for the groupPermission function.</p>
  
  <p>A full image of the page after submitting my two Group (Mailing List) choices is shown below:</p>
  
  <p><a href="https://i.sstatic.net/cPg33.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/cPg33.png" alt="Image of Warning message"></a></p>
  
  <p>More background:</p>
  
  <ol>
  <li>There are two types of pages as the first submenu item under our Get Involved that are setup for an individual to provide their information for subscription to mailing lists:  Logged in and not logged in. This warning happens if they are not logged in (Anonymous user).  Does not happen if you are an Administrator (both as a WordPress user or in the CiviCRM Administrator group) or as a logged in user (Authenticated)</li>
  <li>Some of the Groups were originally created as both a Mailing List AND an Access Control List but I removed the designation that they were an ACL group when I saw this warning since we weren't ready to go full into our implementation of the frontend site.  Changing the Groups back to a Mailing List only still did not get rid of the Warning.  </li>
  <li>At one point I installed the BuddyPress Group sync but I Deactivated the plugin since I didn't want to use it yet.</li>
  <li>PHP 5.6, WordPress 4.9.2, CiviCRM 4.7, BuddyPress 2.9.3, BP XProfile WordPress User Sync 0.6.4, BP Groups CiviCRM Sync 0.3.5 (Deactivated)</li>
  </ol>
  
  <p>Thoughts on how to remove the warning or complete the ACL such that there are no warnings?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-05T17:55:08.817Z
Comments.Text: What permissions do your users have for accessing groups? Admins have all permissions of course, so the issue won't be encountered. FWIW, I think it unlikely that the deactivated BP Groups CiviCRM Sync plugin is the cause since it doesn't touch permissions.
Comments.UserDisplayName: Christian Wach
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-06T19:02:39.523Z
Comments.Text: Thank you for your time, Christian.  When I tested it a day or two ago after posting this, it seems an Authenticated user is not getting an error now, but only Anonymous users are.  The only change I recall is that the User I was testing with above had just been created, so thinking a cache issue, but not positive on that since I was tweaking the ACLs in WordPress.  I've currently turned the 'Display errors' off in my PHP until I found a solution since the warning was to Anonymous subscribers only now and...first appearances are everything.  ;-)  Let me look up my current settings...
Comments.UserDisplayName: ChaosBuster
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-06T19:04:41.973Z
Comments.Text: NOTE: I can update the problem above to not indicate a problem with Authenticated users once we find the resolution for Anonymous users.
Comments.UserDisplayName: ChaosBuster
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-06T19:06:58.083Z
Comments.Text: Will combine WordPress ACL roles of Editor, Author, Contributor and Subscriber into one Authenticated user below for indicating the ACLs.
Comments.UserDisplayName: ChaosBuster
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-06T19:08:16.210Z
Comments.Text: CiviCRM: edit groups 
  Create new groups, edit group settings (e.g. group name, visibility...), delete groups:       Authenticated (None), Anonymous(None)
Comments.UserDisplayName: ChaosBuster
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-06T19:08:50.507Z
Comments.Text: CiviCRM: administer reserved groups 
  Edit and disable Reserved Groups (Needs Edit Groups):   Authenticated (None), Anonymous(None)
Comments.UserDisplayName: ChaosBuster
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-06T19:09:53.130Z
Comments.Text: CiviMail: access CiviMail subscribe/unsubscribe pages 
  Subscribe/unsubscribe from mailing list group: Authenticated (Yes), Anonymous(Yes)
Comments.UserDisplayName: ChaosBuster
Tags: <wordpress><groups><acl>
Title: Access Control issue in CiviCRM with Groups?
ThreadText: # Access Control issue in CiviCRM with Groups?
  
  (Asked by: username_0 on 2018-01-31)
  
  Hoping the CiviCRM expertise here within stackexchange can provide some guidance on a warning I'm seeing...
  
  When an Anonymous individual on our WordPress CiviCRM site has a Group (Mailing List) selected in a Profile they are shown the following Warning message. Each Warning message is shown twice for each Group selected by the user.
  
  ***Warning:*** in\_array() expects parameter 2 to be array, null given in /home/coloradomaker/www/www/wp-content/plugins/civicrm/civicrm/CRM/ACL/API.php on line 218
  
  Line 218 is the return statement for the groupPermission function.
  
  A full image of the page after submitting my two Group (Mailing List) choices is shown below:
  
  [![Image of Warning message](https://i.sstatic.net/cPg33.png)](https://i.sstatic.net/cPg33.png)
  
  More background:
  
  1. There are two types of pages as the first submenu item under our Get Involved that are setup for an individual to provide their information for subscription to mailing lists: Logged in and not logged in. This warning happens if they are not logged in (Anonymous user). Does not happen if you are an Administrator (both as a WordPress user or in the CiviCRM Administrator group) or as a logged in user (Authenticated)
  2. Some of the Groups were originally created as both a Mailing List AND an Access Control List but I removed the designation that they were an ACL group when I saw this warning since we weren't ready to go full into our implementation of the frontend site. Changing the Groups back to a Mailing List only still did not get rid of the Warning.
  3. At one point I installed the BuddyPress Group sync but I Deactivated the plugin since I didn't want to use it yet.
  4. PHP 5.6, WordPress 4.9.2, CiviCRM 4.7, BuddyPress 2.9.3, BP XProfile WordPress User Sync 0.6.4, BP Groups CiviCRM Sync 0.3.5 (Deactivated)
  
  Thoughts on how to remove the warning or complete the ACL such that there are no warnings?
  
  **Tags:** wordpress, groups, acl
  
  > **Comments:**
  > **username_1**: What permissions do your users have for accessing groups? Admins have all permissions of course, so the issue won't be encountered. FWIW, I think it unlikely that the deactivated BP Groups CiviCRM Sync plugin is the cause since it doesn't touch permissions.  
  > **username_0**: Thank you for your time, Christian.  When I tested it a day or two ago after posting this, it seems an Authenticated user is not getting an error now, but only Anonymous users are.  The only change I recall is that the User I was testing with above had just been created, so thinking a cache issue, but not positive on that since I was tweaking the ACLs in WordPress.  I've currently turned the 'Display errors' off in my PHP until I found a solution since the warning was to Anonymous subscribers only now and...first appearances are everything.  ;-)  Let me look up my current settings...  
  > **username_0**: NOTE: I can update the problem above to not indicate a problem with Authenticated users once we find the resolution for Anonymous users.  
  > **username_0**: Will combine WordPress ACL roles of Editor, Author, Contributor and Subscriber into one Authenticated user below for indicating the ACLs.  
  > **username_0**: CiviCRM: edit groups  Create new groups, edit group settings (e.g. group name, visibility...), delete groups:       Authenticated (None), Anonymous(None)  
  > **username_0**: CiviCRM: administer reserved groups  Edit and disable Reserved Groups (Needs Edit Groups):   Authenticated (None), Anonymous(None)  
  > **username_0**: CiviMail: access CiviMail subscribe/unsubscribe pages  Subscribe/unsubscribe from mailing list group: Authenticated (Yes), Anonymous(Yes)  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-02-07. Score: 1
  
  I can confirm the warning on a vanilla CiviCRM install. Creating an ACL for the mailing list group(s) fixes it, but that doesn't seem right because:
  
  > The anonymous role (public in Joomla!) applies to all visitors to the
  > website who have not logged in. This role will have the lowest level
  > of permissions. The default CiviCRM permissions for this role are
  > [...] subscribe and unsubscribe from mailing lists
  > <https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/>
  
  So in principle this shouldn't be necessary.
  
  The problem actually lies in the `CRM_ACL_BAO_ACL::group()` method because the cache returns `NULL` rather than an empty array. This then gets passed back unchecked to `CRM_ACL_API::groupPermission()` where the warning is issued.
  
  Two options for you then:
  
  * Raise an issue on Jira and get the problem fixed
  * Suppress warnings and write them to a log file instead
  
  Doing both would be the responsible way to go :-)
  
  > **Comments:**
  > **username_0**: Thanks, Christian, for confirming. Have already done the 2nd suggestion and will raise the issue in Jira for the long-term resolution. Will also change the original problem to indicate the problem was with Anonymous users only.  
  > **username_1**: @username_0 Post the link to the Jira issue and I can help resolve it.  
  > **username_0**: Hmm, I did last week...let me recheck to see.  It should have the same title with 'Anonymous user only' addition.  
  > **username_0**: Here it is: https://issues.civicrm.org/jira/browse/CRM-21757  
  > **username_0**: Let me know if there are parameters that I did not 'chose wisely' for it to be found or assigned.  ;-)  
  > **username_1**: @username_0 Seems this has already been fixed in 4.7.27+. See https://github.com/civicrm/civicrm-core/blame/master/CRM/ACL/BAO/ACL.php#L884  
  > **username_0**: Awesome.  I will look into updating.  Had some updates this weekend to do so will see what impact it will be to just update CiviCRM too.  Thank you for your time and follow through, Christian!  
  > **username_0**: Was able to get some time today and do the update from 4.7.29 to 4.7.30 and confirm that it is fixed.  Thank you!  
  
  ---
  
  