"The page isn't redirecting properly" when clicking activity

[jameshh93]

Before the buddypress 3.0 update when clicking an activity instead of showing the acivity post I just get "The page isn't redirecting properly". Same thing happens when selecting "View Conversation" as well.

For example selecting:
​http://utterz.com/feed-2/p/1616/

Acivity displays correctly on users profile the acivity displays as expected

​http://utterz.com/members/dave-perry/

and on main acivity feed.

Everything was working before updated to version 3.0

[DJPaul]

Confirmed and caused by r11881.

Affects unauthenticated users.

[DJPaul]

I think the root cause is that we used to assume everyone had access to an activity unless they met a blacklist condition, and now we assume no-one has access to an activity unless they meet a whitelist.

[r-a-y]

The problem is with the bp_activity_user_can_read() function (see #7048). It doesn't check for unauthenticated users.

In 01.patch, I suggest setting the default return value to true and doing checks for conditions that require false values. I've also added a check for spammed activity items, which is missing from v3.0.

The patch fails the test_user_cannot_access_someone_elses_activity() test:
​https://buddypress.trac.wordpress.org/browser/tags/3.0.0/tests/phpunit/testcases/activity/functions.php?marks=1506#L1493

However, that test seems incorrect to me. A user should be able to view another person's activity, unless it is restricted in some manner.

[DJPaul]

Agree with all. Nice work.

[r-a-y]

Before committing, I'd like feedback from @espellcaste on the failing unit test and what the purpose is. Might be related to something specific for the WP-CLI Activity module.

[DJPaul]

Milestone renamed

[espellcaste]

@DJPaul and @r-a-y

Right now I don't remember why this test test_user_cannot_access_someone_elses_activity was introduced. I've looked at the BP REST API and it doesn't seem something related to it.

I think it can be removed.

I'm adding a patch with small fixes and more unit tests. :)

[r-a-y]

@espellcaste - Looks good!

Can we remove the test_user_cannot_access_someone_elses_activity() test? Otherwise, feel free to commit.

[djpaul]

In 12154:

Activity: fix activity permalinks for unauthenticated users.

This change also re-adds the block on accessing spammed activity items.

Fixes #7843

Props r-a-y, espellcaste

[djpaul]

In 12155:

Activity: fix activity permalinks for unauthenticated users.

This change also re-adds the block on accessing spammed activity items.

Fixes #7843

Props r-a-y, espellcaste