dashboard: don't be merge activites with different user

circle/dashboard/views.py

@@ -2092,7 +2092,7 @@ class LeaseDelete(LoginRequiredMixin, SuperuserRequiredMixin, DeleteView):
 @require_GET
 def vm_activity(request, pk):
     instance = Instance.objects.get(pk=pk)
-    if not instance.has_level(request.user, 'owner'):
+    if not instance.has_level(request.user, 'user'):
         raise PermissionDenied()
 
     response = {}

circle/vm/models/instance.py

@@ -937,6 +937,7 @@ class Instance(AclBase, VirtualMachineDescModel, StatusModel, OperatedMixin,
             if (latest == a.activity_code and
                     merged_acts[-1].result == a.result and
                     a.finished and merged_acts[-1].finished and
+                    a.user == merged_acts[-1].user and
                     (merged_acts[-1].finished - a.finished).days < 7 and
                     not a.activity_code.endswith(whitelist)):
                 merged_acts[-1].times += 1