← All changes | includes/rest/class-server.php +18 -17 1.2.0 → 3.2.2 View file →

		@@ -4,9 +4,9 @@
4	4	use stdClass;
5	5	use WP_Error;
6	6	use WP_REST_Response;
7	7	use Activitypub\Signature;
8		-use Activitypub\Model\Application_User;
	8	+use Activitypub\Model\Application;
9	9
10	10	/**
11	11	* ActivityPub Server REST-Class
12	12	*
		@@ -46,14 +46,10 @@
46	46	*
47	47	* @return WP_REST_Response The JSON profile of the Application Actor.
48	48	*/
49	49	public static function application_actor() {
50		- $user = new Application_User();
	50	+ $user = new Application();
51	51
52		- $user->set_context(
53		- \Activitypub\Activity\Activity::CONTEXT
54		- );
55		-
56	52	$json = $user->to_array();
57	53
58	54	$rest_response = new WP_REST_Response( $json, 200 );
59	55	$rest_response->header( 'Content-Type', 'application/activity+json; charset=' . get_option( 'blog_charset' ) );
		@@ -65,8 +61,11 @@
65	61	* Callback function to authorize each api requests
66	62	*
67	63	* @see WP_REST_Request
68	64	*
	65	+ * @see https://www.w3.org/wiki/SocialCG/ActivityPub/Primer/Authentication_Authorization#Authorized_fetch
	66	+ * @see https://swicg.github.io/activitypub-http-signature/#authorized-fetch
	67	+ *
69	68	* @param WP_REST_Response|WP_HTTP_Response|WP_Error|mixed $response Result to send to the client.
70	69	* Usually a WP_REST_Response or WP_Error.
71	70	* @param array $handler Route handler used for the request.
72	71	* @param WP_REST_Request $request Request used to generate the response.
		@@ -83,9 +82,10 @@
83	82	// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints
84	83	if (
85	84	! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ||
86	85	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) ||
87		- \str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' )
	86	+ \str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' ) ||
	87	+ \str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'application' )
88	88	) {
89	89	return $response;
90	90	}
91	91
		@@ -105,20 +105,21 @@
105	105	if ( $defer ) {
106	106	return $response;
107	107	}
108	108
109		- // POST-Requets are always signed
110		- if ( 'GET' !== $request->get_method() ) {
	109	+ if (
	110	+ // POST-Requests are always signed
	111	+ 'GET' !== $request->get_method() ||
	112	+ // GET-Requests only require a signature in secure mode
	113	+ ( 'GET' === $request->get_method() && ACTIVITYPUB_AUTHORIZED_FETCH )
	114	+ ) {
111	115	$verified_request = Signature::verify_http_signature( $request );
112	116	if ( \is_wp_error( $verified_request ) ) {
113		- return new WP_Error( 'activitypub_signature_verification', $verified_request->get_error_message(), array( 'status' => 401 ) );
114		- }
115		- } elseif ( 'GET' === $request->get_method() ) { // GET-Requests are only signed in secure mode
116		- if ( ACTIVITYPUB_AUTHORIZED_FETCH ) {
117		- $verified_request = Signature::verify_http_signature( $request );
118		- if ( \is_wp_error( $verified_request ) ) {
119		- return new WP_Error( 'activitypub_signature_verification', $verified_request->get_error_message(), array( 'status' => 401 ) );
120		- }
	117	+ return new WP_Error(
	118	+ 'activitypub_signature_verification',
	119	+ $verified_request->get_error_message(),
	120	+ array( 'status' => 401 )
	121	+ );
121	122	}
122	123	}
123	124
124	125	return $response;