kawaiipunk/laipower
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

updated plugin ActivityPub version 9.1.0

Browse Source
This commit is contained in:
KawaiiPunk
2026-07-28 15:03:10 +00:00
committed by Gitium
parent bf428f0e45
commit ff806e1811
217 changed files with 6098 additions and 3025 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
wp-content/plugins/activitypub/includes/rest/oauth/class-token-controller.php
View File

@ -313,11 +313,22 @@ class Token_Controller extends \WP_REST_Controller {
// Introspect the token.
$response = Token::introspect( $token );
// Scope introspection to same client: non-admin users can only
// introspect tokens belonging to the same client as their own.
/*
* Scope introspection for non-admins. An OAuth-authenticated caller may only
* introspect tokens issued to its own client; a cookie-authenticated caller may
* only introspect its own tokens. Without the cookie branch, any logged-in user
* could read metadata for any token string, because get_current_token() is null
* for cookie sessions and the same-client check was skipped entirely.
*/
if ( $response['active'] && ! \current_user_can( 'manage_options' ) ) {
$current_token = OAuth_Server::get_current_token();
if ( $current_token && $current_token->get_client_id() !== $response['client_id'] ) {
if ( $current_token ) {
if ( $current_token->get_client_id() !== $response['client_id'] ) {
$response = array( 'active' => false );
}
} elseif ( \get_current_user_id() !== (int) $response['sub'] ) {
// `sub` is stored as a string; cast before comparing with the integer user ID.
$response = array( 'active' => false );
}
}
@ -397,18 +408,25 @@ class Token_Controller extends \WP_REST_Controller {
* @return \WP_REST_Response
*/
private function token_error( $error, $error_description, $status = 400 ) {
$headers = array(
'Content-Type' => 'application/json',
// RFC 6749 §5.1 requires the same no-cache headers on error responses as on success responses.
'Cache-Control' => 'no-store',
'Pragma' => 'no-cache',
);
// RFC 6585 §4: send Retry-After with rate-limit responses so clients can back off.
if ( 429 === $status ) {
$headers['Retry-After'] = (string) MINUTE_IN_SECONDS;
}
return new \WP_REST_Response(
array(
'error' => $error,
'error_description' => $error_description,
),
$status,
array(
'Content-Type' => 'application/json',
// RFC 6749 §5.1 requires the same no-cache headers on error responses as on success responses.
'Cache-Control' => 'no-store',
'Pragma' => 'no-cache',
)
$headers
);
}