Changing the username in an activity permalink can display the activity of another user

[imath]

Step to reproduce:

Post an activity with user A, display the single activity, change the username in the url to user B, the activity is displayed.

I'd suggest to redirect to $activity->user_id 's profile if bp_displayed_user_id() is not consistent.

[r-a-y]

has-access.patch is what I recommended on Slack.

It doesn't require us to write yet another bp_core_redirect() line, which I'm kind of against and because this bug only shows up if someone intentionally modifies the URI.

[imath]

The has-access.patch will end up redirecting to user's profile or login screen. So a logged in user that can access to the activity will get a wrong info. But i'm ok with whatever will be chosen :)

[imath]

@r-a-y actually i have doubts your patch will fix the issue if the user has access to the group in case of a group activity posted by another user.

[r-a-y]

Good catch, imath. Updated patch removes the else check, which should fix the group check issue.

[imath]

Ok, just tested has-access.02. I confirm it's fixing the issue, let's go with it ;)

[r-a-y]

In 10880:

Activity: Ensure that single activity pages are only rendered from the activity author's page.

Props tw2113, imath.

Fixes #7113.