PluginProbe
ActivityPub / 3.2.4
ActivityPub v3.2.4
9.3.1 9.3.0 9.2.2 9.2.1 9.2.0 9.1.0 9.0.2 9.0.1 9.0.0 8.3.0 8.2.1 8.2.0 8.1.1 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.1.0 1.2.0 1.3.0 2.0.0 2.0.1 2.1.0 2.1.1 All 160 releases
← All changes | includes/class-webfinger.php +99 -210 9.2.23.2.4 View file →
@@ -1,19 +1,12 @@
1 1 <?php
2 -/**
3 - * WebFinger class file.
4 - *
5 - * @package Activitypub
6 - */
7 -
8 2 namespace Activitypub;
9 3
10 -use Activitypub\Activity\Actor;
11 -use Activitypub\Collection\Actors;
12 -use Activitypub\Collection\Remote_Actors;
4 +use WP_Error;
5 +use Activitypub\Collection\Users;
13 6
14 7 /**
15 - * ActivityPub WebFinger Class.
8 + * ActivityPub WebFinger Class
16 9 *
17 10 * @author Matthias Pfefferle
18 11 *
19 12 * @see https://webfinger.net/
@@ -19,41 +12,17 @@
19 12 * @see https://webfinger.net/
20 13 */
21 14 class Webfinger {
22 15 /**
23 - * Check whether a value looks like an `acct` identifier.
16 + * Returns a users WebFinger "resource"
24 17 *
25 - * Accepts any of:
18 + * @param int $user_id The WordPress user id
26 19 *
27 - * - `user@host` — bare WebFinger handle.
28 - * - `@user@host` — Mastodon display form with a leading `@`.
29 - * - `acct:user@host` — full RFC 7565 URI form.
30 - *
31 - * The host/local-part pattern follows `ACTIVITYPUB_USERNAME_REGEXP`.
32 - *
33 - * @since 8.3.0
34 - *
35 - * @param mixed $value The candidate value.
36 - * @return bool True if the value matches the acct identifier pattern.
20 + * @return string The user-resource
37 21 */
38 - public static function is_acct( $value ) {
39 - if ( ! \is_string( $value ) || '' === $value ) {
40 - return false;
41 - }
42 -
43 - return (bool) \preg_match( '/^(?:acct:)?@?' . ACTIVITYPUB_USERNAME_REGEXP . '$/i', $value );
44 - }
45 -
46 - /**
47 - * Returns a users WebFinger "resource".
48 - *
49 - * @param int $user_id The WordPress user id.
50 - *
51 - * @return string The user-resource.
52 - */
53 22 public static function get_user_resource( $user_id ) {
54 - $user = Actors::get_by_id( $user_id );
55 - if ( ! $user || \is_wp_error( $user ) ) {
23 + $user = Users::get_by_id( $user_id );
24 + if ( ! $user || is_wp_error( $user ) ) {
56 25 return '';
57 26 }
58 27
59 28 return $user->get_webfinger();
@@ -59,13 +28,13 @@
59 28 return $user->get_webfinger();
60 29 }
61 30
62 31 /**
63 - * Resolve a WebFinger resource.
32 + * Resolve a WebFinger resource
64 33 *
65 - * @param string $uri The WebFinger Resource.
34 + * @param string $uri The WebFinger Resource
66 35 *
67 - * @return string|\WP_Error The URL or WP_Error.
36 + * @return string|WP_Error The URL or WP_Error
68 37 */
69 38 public static function resolve( $uri ) {
70 39 $data = self::get_data( $uri );
71 40
@@ -72,12 +41,12 @@
72 41 if ( \is_wp_error( $data ) ) {
73 42 return $data;
74 43 }
75 44
76 - if ( ! \is_array( $data ) || empty( $data['links'] ) ) {
77 - return new \WP_Error(
45 + if ( ! is_array( $data ) || empty( $data['links'] ) ) {
46 + return new WP_Error(
78 47 'webfinger_missing_links',
79 - \__( 'No valid Link elements found.', 'activitypub' ),
48 + __( 'No valid Link elements found.', 'activitypub' ),
80 49 array(
81 50 'status' => 400,
82 51 'data' => $data,
83 52 )
@@ -86,9 +55,8 @@
86 55
87 56 foreach ( $data['links'] as $link ) {
88 57 if (
89 58 'self' === $link['rel'] &&
90 - isset( $link['type'] ) &&
91 59 (
92 60 'application/activity+json' === $link['type'] ||
93 61 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"' === $link['type']
94 62 )
@@ -96,11 +64,11 @@
96 64 return $link['href'];
97 65 }
98 66 }
99 67
100 - return new \WP_Error(
68 + return new WP_Error(
101 69 'webfinger_url_no_activitypub',
102 - \__( 'The Site supports WebFinger but not ActivityPub', 'activitypub' ),
70 + __( 'The Site supports WebFinger but not ActivityPub', 'activitypub' ),
103 71 array(
104 72 'status' => 400,
105 73 'data' => $data,
106 74 )
@@ -107,24 +75,22 @@
107 75 );
108 76 }
109 77
110 78 /**
111 - * Transform a URI to an acct <identifier>@<host>.
79 + * Transform a URI to an acct <identifier>@<host>
112 80 *
113 - * @see https://swicg.github.io/activitypub-webfinger/#reverse-discovery
81 + * @param string $uri The URI (acct:, mailto:, http:, https:)
114 82 *
115 - * @param string $uri The URI (acct:, mailto:, http:, https:).
116 - *
117 - * @return string|\WP_Error Error or acct URI.
83 + * @return string|WP_Error Error or acct URI
118 84 */
119 85 public static function uri_to_acct( $uri ) {
120 86 $data = self::get_data( $uri );
121 87
122 - if ( \is_wp_error( $data ) ) {
88 + if ( is_wp_error( $data ) ) {
123 89 return $data;
124 90 }
125 91
126 - // Check if subject is an acct URI.
92 + // check if subject is an acct URI
127 93 if (
128 94 isset( $data['subject'] ) &&
129 95 \str_starts_with( $data['subject'], 'acct:' )
130 96 ) {
@@ -130,9 +96,9 @@
130 96 ) {
131 97 return $data['subject'];
132 98 }
133 99
134 - // Search for an acct URI in the aliases.
100 + // search for an acct URI in the aliases
135 101 if ( isset( $data['aliases'] ) ) {
136 102 foreach ( $data['aliases'] as $alias ) {
137 103 if ( \str_starts_with( $alias, 'acct:' ) ) {
138 104 return $alias;
@@ -139,11 +105,11 @@
139 105 }
140 106 }
141 107 }
142 108
143 - return new \WP_Error(
109 + return new WP_Error(
144 110 'webfinger_url_no_acct',
145 - \__( 'No acct URI found.', 'activitypub' ),
111 + __( 'No acct URI found.', 'activitypub' ),
146 112 array(
147 113 'status' => 400,
148 114 'data' => $data,
149 115 )
@@ -153,17 +119,18 @@
153 119 /**
154 120 * Convert a URI string to an identifier and its host.
155 121 * Automatically adds acct: if it's missing.
156 122 *
157 - * @param string $url The URI (acct:, mailto:, http:, https:).
123 + * @param string $url The URI (acct:, mailto:, http:, https:)
158 124 *
159 - * @return \WP_Error|array Error reaction or array with identifier and host as values.
125 + * @return WP_Error|array Error reaction or array with
126 + * identifier and host as values
160 127 */
161 128 public static function get_identifier_and_host( $url ) {
162 129 if ( ! $url ) {
163 - return new \WP_Error(
130 + return new WP_Error(
164 131 'webfinger_invalid_identifier',
165 - \__( 'Invalid Identifier', 'activitypub' ),
132 + __( 'Invalid Identifier', 'activitypub' ),
166 133 array(
167 134 'status' => 400,
168 135 'data' => $url,
169 136 )
@@ -169,17 +136,17 @@
169 136 )
170 137 );
171 138 }
172 139
173 - // Remove leading @.
174 - $url = \ltrim( $url, '@' );
140 + // remove leading @
141 + $url = ltrim( $url, '@' );
175 142
176 - if ( ! \preg_match( '/^([a-zA-Z+]+):/', $url, $match ) ) {
143 + if ( ! preg_match( '/^([a-zA-Z+]+):/', $url, $match ) ) {
177 144 $identifier = 'acct:' . $url;
178 - $scheme = 'acct';
145 + $scheme = 'acct';
179 146 } else {
180 147 $identifier = $url;
181 - $scheme = $match[1];
148 + $scheme = $match[1];
182 149 }
183 150
184 151 $host = null;
185 152
@@ -186,21 +153,21 @@
186 153 switch ( $scheme ) {
187 154 case 'acct':
188 155 case 'mailto':
189 156 case 'xmpp':
190 - if ( \strpos( $identifier, '@' ) !== false ) {
191 - $host = \substr( $identifier, \strpos( $identifier, '@' ) + 1 );
157 + if ( strpos( $identifier, '@' ) !== false ) {
158 + $host = substr( $identifier, strpos( $identifier, '@' ) + 1 );
192 159 }
193 160 break;
194 161 default:
195 - $host = \wp_parse_url( $identifier, PHP_URL_HOST );
162 + $host = wp_parse_url( $identifier, PHP_URL_HOST );
196 163 break;
197 164 }
198 165
199 166 if ( empty( $host ) ) {
200 - return new \WP_Error(
167 + return new WP_Error(
201 168 'webfinger_invalid_identifier',
202 - \__( 'Invalid Identifier', 'activitypub' ),
169 + __( 'Invalid Identifier', 'activitypub' ),
203 170 array(
204 171 'status' => 400,
205 172 'data' => $url,
206 173 )
@@ -210,122 +177,79 @@
210 177 return array( $identifier, $host );
211 178 }
212 179
213 180 /**
214 - * Get the WebFinger data for a given URI.
181 + * Get the WebFinger data for a given URI
215 182 *
216 - * @param string $uri The Identifier: <identifier>@<host> or URI.
183 + * @param string $uri The Identifier: <identifier>@<host> or URI
217 184 *
218 - * @return \WP_Error|array Error reaction or array with identifier and host as values.
185 + * @return WP_Error|array Error reaction or array with
186 + * identifier and host as values
219 187 */
220 188 public static function get_data( $uri ) {
221 189 $identifier_and_host = self::get_identifier_and_host( $uri );
222 190
223 - if ( \is_wp_error( $identifier_and_host ) ) {
191 + if ( is_wp_error( $identifier_and_host ) ) {
224 192 return $identifier_and_host;
225 193 }
226 194
195 + $transient_key = self::generate_cache_key( $uri );
196 +
227 197 list( $identifier, $host ) = $identifier_and_host;
228 198
229 - $webfinger_url = \sprintf(
199 + $data = \get_transient( $transient_key );
200 + if ( $data ) {
201 + return $data;
202 + }
203 +
204 + $webfinger_url = sprintf(
230 205 'https://%s/.well-known/webfinger?resource=%s',
231 206 $host,
232 - \rawurlencode( $identifier )
207 + rawurlencode( $identifier )
233 208 );
234 209
235 - // Use Http::get() which handles all caching (success and errors).
236 - $response = Http::get(
210 + $response = wp_safe_remote_get(
237 211 $webfinger_url,
238 - array( 'headers' => array( 'Accept' => 'application/jrd+json' ) ),
239 - WEEK_IN_SECONDS
212 + array(
213 + 'headers' => array( 'Accept' => 'application/jrd+json' ),
214 + )
240 215 );
241 216
242 - if ( \is_wp_error( $response ) ) {
243 - return $response;
217 + if ( is_wp_error( $response ) ) {
218 + return new WP_Error(
219 + 'webfinger_url_not_accessible',
220 + __( 'The WebFinger Resource is not accessible.', 'activitypub' ),
221 + array(
222 + 'status' => 400,
223 + 'data' => $webfinger_url,
224 + )
225 + );
244 226 }
245 227
246 - $body = \wp_remote_retrieve_body( $response );
228 + $body = wp_remote_retrieve_body( $response );
229 + $data = json_decode( $body, true );
247 230
248 - return \json_decode( $body, true );
231 + \set_transient( $transient_key, $data, WEEK_IN_SECONDS );
232 +
233 + return $data;
249 234 }
250 235
251 236 /**
252 - * Get the Remote-Follow endpoint for a given URI.
237 + * Get the Remote-Follow endpoint for a given URI
253 238 *
254 - * @param string $uri The WebFinger Resource URI.
255 - *
256 - * @return string|\WP_Error Error or the Remote-Follow endpoint URI.
239 + * @return string|WP_Error Error or the Remote-Follow endpoint URI.
257 240 */
258 241 public static function get_remote_follow_endpoint( $uri ) {
259 - return self::get_intent_endpoint( $uri, 'follow', true );
260 - }
261 -
262 - /**
263 - * Generate a cache key for a given URI.
264 - *
265 - * @param string $uri A WebFinger Resource URI.
266 - *
267 - * @return string The cache key.
268 - */
269 - public static function generate_cache_key( $uri ) {
270 - $uri = \ltrim( $uri, '@' );
271 -
272 - if ( \filter_var( $uri, FILTER_VALIDATE_EMAIL ) ) {
273 - $uri = 'acct:' . $uri;
274 - }
275 -
276 - return 'webfinger_' . \md5( $uri );
277 - }
278 -
279 - /**
280 - * Infer a shortname from the Actor ID or URL. Used only for fallbacks,
281 - * we will try to use what's supplied.
282 - *
283 - * @param Actor|string $actor_or_uri The Actor or URI.
284 - *
285 - * @return string Hopefully the name of the Follower.
286 - */
287 - public static function guess( $actor_or_uri ) {
288 - if ( ! $actor_or_uri instanceof Actor ) {
289 - $actor = Remote_Actors::fetch_by_uri( $actor_or_uri );
290 - if ( \is_wp_error( $actor ) ) {
291 - return extract_name_from_uri( $actor_or_uri ) . '@' . \wp_parse_url( $actor_or_uri, PHP_URL_HOST );
292 - }
293 -
294 - $actor_or_uri = $actor;
295 - }
296 -
297 - if ( $actor_or_uri->get_preferred_username() ) {
298 - return $actor_or_uri->get_preferred_username() . '@' . \wp_parse_url( $actor_or_uri->get_id(), PHP_URL_HOST );
299 - }
300 -
301 - return extract_name_from_uri( $actor_or_uri->get_id() ) . '@' . \wp_parse_url( $actor_or_uri->get_id(), PHP_URL_HOST );
302 - }
303 -
304 - /**
305 - * Get the Intent endpoint for a given URI and intent.
306 - *
307 - * @since 8.0.0
308 - *
309 - * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/3b86/fep-3b86.md
310 - *
311 - * @param string $uri The WebFinger Resource URI.
312 - * @param string $intent The intent to look for.
313 - * @param bool $fallback Whether to fallback to the Remote-Follow endpoint.
314 - *
315 - * @return string|\WP_Error Error or the Intent endpoint URI (may contain `{uri}` placeholder).
316 - */
317 - public static function get_intent_endpoint( $uri, $intent, $fallback = false ) {
318 242 $data = self::get_data( $uri );
319 243
320 - if ( \is_wp_error( $data ) ) {
244 + if ( is_wp_error( $data ) ) {
321 245 return $data;
322 246 }
323 247
324 248 if ( empty( $data['links'] ) ) {
325 - return new \WP_Error(
249 + return new WP_Error(
326 250 'webfinger_missing_links',
327 - \__( 'No valid Link elements found.', 'activitypub' ),
251 + __( 'No valid Link elements found.', 'activitypub' ),
328 252 array(
329 253 'status' => 400,
330 254 'data' => $data,
331 255 )
@@ -331,72 +255,37 @@
331 255 )
332 256 );
333 257 }
334 258
335 - // Normalize the links with $rel as key.
336 - $links = array();
337 -
338 259 foreach ( $data['links'] as $link ) {
339 - if ( isset( $link['rel'] ) && isset( $link['template'] ) ) {
340 - $links[ \strtolower( $link['rel'] ) ] = $link['template'];
260 + if ( 'http://ostatus.org/schema/1.0/subscribe' === $link['rel'] ) {
261 + return $link['template'];
341 262 }
342 263 }
343 264
344 - $intent = \sanitize_text_field( $intent );
345 - $intent = \strtolower( $intent );
265 + return new WP_Error(
266 + 'webfinger_missing_remote_follow_endpoint',
267 + __( 'No valid Remote-Follow endpoint found.', 'activitypub' ),
268 + array(
269 + 'status' => 400,
270 + 'data' => $data,
271 + )
272 + );
273 + }
346 274
347 - if ( ! \filter_var( $intent, FILTER_VALIDATE_URL ) ) {
348 - $intent = 'https://w3id.org/fep/3b86/' . $intent;
349 - }
275 + /**
276 + * Generate a cache key for a given URI
277 + *
278 + * @param string $uri A WebFinger Resource URI
279 + *
280 + * @return string The cache key
281 + */
282 + public static function generate_cache_key( $uri ) {
283 + $uri = ltrim( $uri, '@' );
350 284
351 - if ( isset( $links[ $intent ] ) ) {
352 - return $links[ $intent ];
285 + if ( filter_var( $uri, FILTER_VALIDATE_EMAIL ) ) {
286 + $uri = 'acct:' . $uri;
353 287 }
354 288
355 - if ( ! $fallback ) {
356 - return new \WP_Error(
357 - 'webfinger_missing_intent_endpoint',
358 - \__( 'No valid Intent endpoint found.', 'activitypub' ),
359 - array(
360 - 'status' => 400,
361 - 'data' => $data,
362 - )
363 - );
364 - }
365 -
366 - /*
367 - * OStatus subscribe URL (deprecated but still widely supported)
368 - *
369 - * @see https://ostatus.github.io/spec/OStatus%201.0%20Draft%202.html#anchor10
370 - */
371 - if ( isset( $links['http://ostatus.org/schema/1.0/subscribe'] ) ) {
372 - return $links['http://ostatus.org/schema/1.0/subscribe'];
373 - }
374 -
375 - /*
376 - * FEP-3b86 Object Intent — the generic "open this object on my home
377 - * server" link, equivalent to pasting the URL into the home server's
378 - * search box. Useful when no verb-specific intent is advertised.
379 - *
380 - * @see https://codeberg.org/fediverse/fep/src/branch/main/fep/3b86/fep-3b86.md#5-1-object-intent
381 - */
382 - if ( isset( $links['https://w3id.org/fep/3b86/object'] ) ) {
383 - return $links['https://w3id.org/fep/3b86/object'];
384 - }
385 -
386 - // Last-resort: construct a Mastodon-compatible authorize_interaction URL.
387 - $identifier_and_host = self::get_identifier_and_host( $uri );
388 -
389 - if ( \is_wp_error( $identifier_and_host ) ) {
390 - return new \WP_Error(
391 - 'webfinger_missing_intent_endpoint',
392 - \__( 'No valid Intent endpoint found.', 'activitypub' ),
393 - array(
394 - 'status' => 400,
395 - 'data' => $data,
396 - )
397 - );
398 - }
399 -
400 - return 'https://' . $identifier_and_host[1] . '/authorize_interaction?uri={uri}';
289 + return 'webfinger_' . md5( $uri );
401 290 }
402 291 }