kawaiipunk/laipower
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

updated plugin ActivityPub version 9.1.0

Browse Source
This commit is contained in:
KawaiiPunk
2026-07-28 15:03:10 +00:00
committed by Gitium
parent bf428f0e45
commit ff806e1811
217 changed files with 6098 additions and 3025 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
wp-content/plugins/activitypub/includes/collection/class-inbox.php
View File

@ -117,14 +117,14 @@ class Inbox {
$inbox_item = array(
'post_type' => self::POST_TYPE,
'post_title' => sprintf(
'post_title' => \sprintf(
/* translators: 1. Activity type, 2. Object Title or Excerpt */
\__( '[%1$s] %2$s', 'activitypub' ),
$activity->get_type(),
\wp_trim_words( $title, 5 )
),
// Persist the blind audience so we keep the full addressing the sender used.
'post_content' => wp_slash( $activity->to_json( true, true ) ),
'post_content' => \wp_slash( $activity->to_json( true, true ) ),
'post_author' => 0, // No specific author, recipients stored in meta.
'post_status' => 'publish',
'guid' => $activity->get_id(),
@ -166,7 +166,7 @@ class Inbox {
* @return string The title.
*/
private static function get_object_title( $activity_object ) {
if ( ! $activity_object || is_array( $activity_object ) ) {
if ( ! $activity_object || \is_array( $activity_object ) ) {
return '';
}
@ -228,11 +228,14 @@ class Inbox {
/**
* Undo a received activity.
*
* @param string $id The ID of the inbox item to be removed.
* @param string $id The ID of the inbox item to be removed.
* @param string|null $actor Optional. The actor URI of the Undo sender. When provided, the
* activity is only undone if this actor created the original
* activity. Default null.
*
* @return bool|\WP_Error True on success, WP_Error on failure.
*/
public static function undo( $id ) {
public static function undo( $id, $actor = null ) {
$inbox_item = self::get_by_guid( $id );
if ( \is_wp_error( $inbox_item ) ) {
@ -240,6 +243,23 @@ class Inbox {
return $inbox_item;
}
/*
* Only the actor that created the original activity may undo it. Without this
* binding a remote server could undo (and, for interactions, force-delete the
* comment behind) any activity whose public id it knows but does not own.
*
* Items stored before this meta existed have no actor recorded; those are let
* through for backward compatibility rather than becoming permanently un-undoable.
*/
$stored_actor = \get_post_meta( $inbox_item->ID, '_activitypub_activity_remote_actor', true );
if ( null !== $actor && $stored_actor && object_to_uri( $actor ) !== $stored_actor ) {
return new \WP_Error(
'activitypub_inbox_undo_forbidden',
\__( 'Undo is not possible because the actor does not own the activity.', 'activitypub' ),
array( 'status' => 403 )
);
}
$type = \get_post_meta( $inbox_item->ID, '_activitypub_activity_type', true );
switch ( $type ) {
@ -266,7 +286,7 @@ class Inbox {
);
}
$result = Comment::object_id_to_comment( esc_url_raw( $inbox_item->guid ) );
$result = Comment::object_id_to_comment( \esc_url_raw( $inbox_item->guid ) );
if ( empty( $result ) ) {
return new \WP_Error(
@ -474,7 +494,7 @@ class Inbox {
}
// Keep the first (oldest) post as primary.
$primary_id = array_shift( $post_ids );
$primary_id = \array_shift( $post_ids );
$primary = \get_post( $primary_id );
// Merge recipients from duplicates into primary and delete duplicates.