kawaiipunk/laipower
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

updated plugin ActivityPub version 9.1.0

Browse Source
This commit is contained in:
KawaiiPunk
2026-07-28 15:03:10 +00:00
committed by Gitium
parent bf428f0e45
commit ff806e1811
217 changed files with 6098 additions and 3025 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
wp-content/plugins/activitypub/includes/handler/class-undo.php
View File

@ -31,7 +31,24 @@ class Undo {
*/
public static function handle_undo( $activity, $user_ids ) {
$success = false;
$result = Inbox_Collection::undo( object_to_uri( $activity['object'] ) );
/*
* Resolve the sender so Inbox::undo() can verify ownership. A genuinely absent actor
* maps to null (no ownership check, for programmatic callers), but an actor that is
* present yet unparseable must be rejected rather than skipping the check — passing
* null there would re-open the undo-by-id attack.
*/
$actor = isset( $activity['actor'] ) ? object_to_uri( $activity['actor'] ) : null;
if ( isset( $activity['actor'] ) && empty( $actor ) ) {
$result = new \WP_Error(
'activitypub_undo_invalid_actor',
\__( 'The Undo activity has an invalid actor.', 'activitypub' ),
array( 'status' => 400 )
);
} else {
$result = Inbox_Collection::undo( object_to_uri( $activity['object'] ), $actor );
}
if ( $result && ! \is_wp_error( $result ) ) {
$success = true;