Fix dashboard activity stream from followed groups

It was returning all activities from the entire site, fix to return
activities from followed groups only.

The tests didn't catch this error because they didn't test doing random
activities that should _not_ appear in the user's dashboard and
asserting that they don't.

Add a quick test that catches this.

This is probably a problem for the other activity streams tests in
test_activity.py as well.

ckan/model/activity.py

@@ -212,9 +212,9 @@ def _activities_from_groups_followed_by_user_query(user_id):
         # Return a query with no results.
         return model.Session.query(model.Activity).filter("0=1")
 
-    q = model.Session.query(model.Activity)
+    q = _group_activity_query(follower_objects[0].object_id)
     q = q.union_all(*[_group_activity_query(follower.object_id)
-            for follower in follower_objects])
+        for follower in follower_objects[1:]])
     return q
 
 

ckan/tests/functional/api/test_dashboard.py

@@ -316,3 +316,18 @@ def test_08_maximum_number_of_new_activities(self):
                 extra_environ={'Authorization': str(self.joeadmin['apikey'])})
             assert response.json['success'] is True
         assert self.dashboard_new_activities_count(self.new_user) == 15
+
+    def test_09_activities_that_should_not_show(self):
+        '''Test that other activities do not appear on the user's dashboard.'''
+
+        before = self.dashboard_activity_list(self.new_user)
+
+        # Make someone else who new_user is not following create a new dataset.
+        params = json.dumps({'name': 'irrelevant_dataset'})
+        response = self.app.post('/api/action/package_create', params=params,
+            extra_environ={'Authorization': str(self.testsysadmin['apikey'])})
+        assert response.json['success'] is True
+
+        after = self.dashboard_activity_list(self.new_user)
+
+        assert before == after