kawaiipunk/laipower
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

updated plugin ActivityPub version 9.1.0

Browse Source
This commit is contained in:
KawaiiPunk
2026-07-28 15:03:10 +00:00
committed by Gitium
parent bf428f0e45
commit ff806e1811
217 changed files with 6098 additions and 3025 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
wp-content/plugins/activitypub/includes/rest/class-outbox-controller.php
View File

@ -18,7 +18,6 @@ use function Activitypub\get_masked_wp_version;
use function Activitypub\get_object_id;
use function Activitypub\get_rest_url_by_path;
use function Activitypub\object_to_uri;
use function Activitypub\user_can_act_as_blog;
/**
* ActivityPub Outbox Controller.
@ -180,23 +179,16 @@ class Outbox_Controller extends \WP_REST_Controller {
);
/*
* Whether the current user owns the outbox being queried. Owners see private
* and non-public activity types without the visibility filters below.
* Whether the current user owns the outbox being queried. Owners see private and
* non-public activity types; unauthenticated, federation, and non-owner requests are
* limited to the public subset by the visibility filter below.
*
* For the blog actor (user_id = 0) the identity-equality check is wrong on
* two counts — `get_current_user_id()` returns 0 for anonymous visitors (so
* `0 === 0` would leak everything to the public), and AP-capable authors
* would otherwise pass the `current_user_can( 'activitypub' )` arm and read
* the blog's private Accepts. Delegate to the capability helper instead.
* Reuse the canonical ownership gate (the same check the OAuth C2S path applies via
* maybe_verify_owner()) instead of re-deriving it here: it requires an authenticated
* session, matches the requested user by identity, and handles the blog actor via
* user_can_act_as_blog(). A global capability never stands in for ownership.
*/
if ( Actors::BLOG_USER_ID === (int) $user_id ) {
$is_outbox_owner = user_can_act_as_blog();
} else {
$is_outbox_owner = \is_user_logged_in() && (
\get_current_user_id() === (int) $user_id
|| \current_user_can( 'activitypub' )
);
}
$is_outbox_owner = true === $this->verify_owner( $request );
if ( ! $is_outbox_owner ) {
$args['meta_query'][] = array(
@ -233,7 +225,7 @@ class Outbox_Controller extends \WP_REST_Controller {
$response = array(
'@context' => Base_Object::JSON_LD_CONTEXT,
'id' => get_rest_url_by_path( sprintf( 'actors/%d/outbox', $user_id ) ),
'id' => get_rest_url_by_path( \sprintf( 'actors/%d/outbox', $user_id ) ),
'generator' => 'https://wordpress.org/?v=' . get_masked_wp_version(),
'actor' => $user->get_id(),
'type' => 'OrderedCollection',
@ -437,7 +429,7 @@ class Outbox_Controller extends \WP_REST_Controller {
// Determine if this is an Activity or a bare Object.
$type = $data['type'] ?? '';
$is_activity = in_array( $type, Activity::TYPES, true );
$is_activity = \in_array( $type, Activity::TYPES, true );
// If it's a bare object, wrap it in a Create activity.
if ( ! $is_activity ) {
@ -548,7 +540,7 @@ class Outbox_Controller extends \WP_REST_Controller {
}
}
return array_merge(
return \array_merge(
array(
'@context' => Base_Object::JSON_LD_CONTEXT,
'type' => 'Create',
@ -593,7 +585,7 @@ class Outbox_Controller extends \WP_REST_Controller {
// Check object.attributedTo if present.
$object = $data['object'] ?? $data;
if ( is_array( $object ) && ! empty( $object['attributedTo'] ) ) {
if ( \is_array( $object ) && ! empty( $object['attributedTo'] ) ) {
$attributed_to = object_to_uri( $object['attributedTo'] );
if ( $attributed_to && $attributed_to !== $user_actor_id ) {
return new \WP_Error(
@ -644,12 +636,12 @@ class Outbox_Controller extends \WP_REST_Controller {
$cc = (array) ( $activity['cc'] ?? array() );
// Check if public.
if ( in_array( $public, $to, true ) ) {
if ( \in_array( $public, $to, true ) ) {
return ACTIVITYPUB_CONTENT_VISIBILITY_PUBLIC;
}
// Check if unlisted (public in cc).
if ( in_array( $public, $cc, true ) ) {
if ( \in_array( $public, $cc, true ) ) {
return ACTIVITYPUB_CONTENT_VISIBILITY_QUIET_PUBLIC;
}
@ -670,7 +662,7 @@ class Outbox_Controller extends \WP_REST_Controller {
*/
private function ensure_object_id( $data, $user ) {
// Check if there's an embedded object that needs fields.
if ( ! isset( $data['object'] ) || ! is_array( $data['object'] ) ) {
if ( ! isset( $data['object'] ) || ! \is_array( $data['object'] ) ) {
return $data;
}