← All changes | includes/rest/class-server.php +13 -14 2.1.1 → 3.2.2 View file →

		@@ -4,9 +4,9 @@
4	4	use stdClass;
5	5	use WP_Error;
6	6	use WP_REST_Response;
7	7	use Activitypub\Signature;
8		-use Activitypub\Model\Application_User;
	8	+use Activitypub\Model\Application;
9	9
10	10	/**
11	11	* ActivityPub Server REST-Class
12	12	*
		@@ -46,9 +46,9 @@
46	46	*
47	47	* @return WP_REST_Response The JSON profile of the Application Actor.
48	48	*/
49	49	public static function application_actor() {
50		- $user = new Application_User();
	50	+ $user = new Application();
51	51
52	52	$json = $user->to_array();
53	53
54	54	$rest_response = new WP_REST_Response( $json, 200 );
		@@ -61,8 +61,11 @@
61	61	* Callback function to authorize each api requests
62	62	*
63	63	* @see WP_REST_Request
64	64	*
	65	+ * @see https://www.w3.org/wiki/SocialCG/ActivityPub/Primer/Authentication_Authorization#Authorized_fetch
	66	+ * @see https://swicg.github.io/activitypub-http-signature/#authorized-fetch
	67	+ *
65	68	* @param WP_REST_Response|WP_HTTP_Response|WP_Error|mixed $response Result to send to the client.
66	69	* Usually a WP_REST_Response or WP_Error.
67	70	* @param array $handler Route handler used for the request.
68	71	* @param WP_REST_Request $request Request used to generate the response.
		@@ -79,9 +82,10 @@
79	82	// check if it is an activitypub request and exclude webfinger and nodeinfo endpoints
80	83	if (
81	84	! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ||
82	85	\str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'webfinger' ) ||
83		- \str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' )
	86	+ \str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'nodeinfo' ) ||
	87	+ \str_starts_with( $route, '/' . \trailingslashit( ACTIVITYPUB_REST_NAMESPACE ) . 'application' )
84	88	) {
85	89	return $response;
86	90	}
87	91
		@@ -101,19 +105,14 @@
101	105	if ( $defer ) {
102	106	return $response;
103	107	}
104	108
105		- // POST-Requets are always signed
106		- if ( 'GET' !== $request->get_method() ) {
107		- $verified_request = Signature::verify_http_signature( $request );
108		- if ( \is_wp_error( $verified_request ) ) {
109		- return new WP_Error(
110		- 'activitypub_signature_verification',
111		- $verified_request->get_error_message(),
112		- array( 'status' => 401 )
113		- );
114		- }
115		- } elseif ( 'GET' === $request->get_method() && ACTIVITYPUB_AUTHORIZED_FETCH ) { // GET-Requests are only signed in secure mode
	109	+ if (
	110	+ // POST-Requests are always signed
	111	+ 'GET' !== $request->get_method() ||
	112	+ // GET-Requests only require a signature in secure mode
	113	+ ( 'GET' === $request->get_method() && ACTIVITYPUB_AUTHORIZED_FETCH )
	114	+ ) {
116	115	$verified_request = Signature::verify_http_signature( $request );
117	116	if ( \is_wp_error( $verified_request ) ) {
118	117	return new WP_Error(
119	118	'activitypub_signature_verification',