CRM-16711 - make CRM_Contact_DAO_Relationship::makeURLClause ACL-aware.

[davejenx]

As described in CRM-9335 and CRM-16711, a contact lacking 'view all contacts' permission can view basic contact details of any contact they're related to, via the relationships tab, even if they're not permitted to view those contacts. This change applies ACL permissioning to the query used to retrieve relationships, so that a contact will only see relationships to contacts they're permitted to view.

[davejenx]

This change needs review. It has been in use on one site for over 3 years with no problems reported but I think the following points need consideration.

• Is the change too generic: will it restrict queries in cases where they should not be restricted? Might we need a check_permissions flag?
• Query efficiency: I used a subquery because this allowed me to use the results of CRM_ACL_API::whereClause / CRM_Contact_BAO_Query::fromClause . But subqueries aren't very efficient in MySQL.
• Testing: Lobo suggested in forum discussion of this issue in 2011, http://forum.civicrm.org/index.php/topic,22007.msg92674.html#msg92674, that "there might be some ACL infrastructure stuff to add to tests". I'm not sure where this is up to now.

[monishdeb]

@davejenx I have found another way to tackle 1 and 2 points . There is no doubt that the current PR changes will work but I found an alternative - #6182 which provides -

1. avoids subquery usage
2. consider ACLware permissions also with other permission checking
   Can you please verify my changes if it works for you ? :)

[monishdeb]

Closed in favor of #6182