← All changes | includes/class-query.php +34 -119 8.2.1 → 5.7.0 View file →

		@@ -6,9 +6,8 @@
6	6	*/
7	7
8	8	namespace Activitypub;
9	9
10		-use Activitypub\Activity\Extended_Object\Quote_Authorization;
11	10	use Activitypub\Collection\Actors;
12	11	use Activitypub\Collection\Outbox;
13	12	use Activitypub\Transformer\Factory;
14	13
		@@ -138,12 +137,8 @@
138	137	*/
139	138	private function prepare_activitypub_data() {
140	139	$queried_object = $this->get_queried_object();
141	140
142		- if ( $queried_object instanceof \WP_Post && \get_query_var( 'stamp' ) ) {
143		- return $this->maybe_get_stamp();
144		- }
145		-
146	141	// Check for Outbox Activity.
147	142	if (
148	143	$queried_object instanceof \WP_Post &&
149	144	Outbox::POST_TYPE === $queried_object->post_type
		@@ -197,16 +192,8 @@
197	192	$queried_object = \get_post( $post_id );
198	193	}
199	194	}
200	195
201		- // Check Term by ID.
202		- if ( ! $queried_object ) {
203		- $term_id = \get_query_var( 'term_id' );
204		- if ( $term_id ) {
205		- $queried_object = \get_term( $term_id );
206		- }
207		- }
208		-
209	196	// Try to get Author by ID.
210	197	if ( ! $queried_object ) {
211	198	$url = $this->get_request_url();
212	199	$author_id = url_to_authorid( $url );
		@@ -260,9 +247,9 @@
260	247	* Get the request URL.
261	248	*
262	249	* @return string|null The request URL.
263	250	*/
264		- public function get_request_url() {
	251	+ protected function get_request_url() {
265	252	if ( ! isset( $_SERVER['REQUEST_URI'] ) ) {
266	253	return null;
267	254	}
268	255
		@@ -279,76 +266,52 @@
279	266	*
280	267	* @return bool True if the request is an ActivityPub request, false otherwise.
281	268	*/
282	269	public function is_activitypub_request() {
283		- if ( ! isset( $this->is_activitypub_request ) ) {
284		- global $wp_query;
	270	+ if ( isset( $this->is_activitypub_request ) ) {
	271	+ return $this->is_activitypub_request;
	272	+ }
285	273
286		- $this->is_activitypub_request = false;
	274	+ global $wp_query;
287	275
288		- // One can trigger an ActivityPub request by adding `?activitypub` to the URL.
289		- if ( isset( $wp_query->query_vars['activitypub'] ) || isset( $_GET['activitypub'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
290		- \defined( 'ACTIVITYPUB_REQUEST' ) || \define( 'ACTIVITYPUB_REQUEST', true );
291		- $this->is_activitypub_request = true;
	276	+ // One can trigger an ActivityPub request by adding `?activitypub` to the URL.
	277	+ if (
	278	+ isset( $wp_query->query_vars['activitypub'] ) ||
	279	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	280	+ isset( $_GET['activitypub'] )
	281	+ ) {
	282	+ \defined( 'ACTIVITYPUB_REQUEST' ) || \define( 'ACTIVITYPUB_REQUEST', true );
	283	+ $this->is_activitypub_request = true;
292	284
293		- // The other (more common) option to make an ActivityPub request is to send an Accept header.
294		- } elseif ( isset( $_SERVER['HTTP_ACCEPT'] ) ) {
295		- $accept = \sanitize_text_field( \wp_unslash( $_SERVER['HTTP_ACCEPT'] ) );
296		-
297		- /*
298		- * $accept can be a single value, or a comma separated list of values.
299		- * We want to support both scenarios,
300		- * and return true when the header includes at least one of the following:
301		- * - application/activity+json
302		- * - application/ld+json
303		- * - application/json
304		- */
305		- if ( \preg_match( '/(application\/(ld\+json|activity\+json|json))/i', $accept ) ) {
306		- \defined( 'ACTIVITYPUB_REQUEST' ) || \define( 'ACTIVITYPUB_REQUEST', true );
307		- $this->is_activitypub_request = true;
308		- }
309		- }
	285	+ return true;
310	286	}
311	287
312		- /**
313		- * Filters whether the current request is an ActivityPub request.
314		- *
315		- * @param bool $is_activitypub_request True if the request is an ActivityPub request, false otherwise.
	288	+ /*
	289	+ * The other (more common) option to make an ActivityPub request
	290	+ * is to send an Accept header.
316	291	*/
317		- return \apply_filters( 'activitypub_is_activitypub_request', $this->is_activitypub_request );
318		- }
	292	+ if ( isset( $_SERVER['HTTP_ACCEPT'] ) ) {
	293	+ $accept = \sanitize_text_field( \wp_unslash( $_SERVER['HTTP_ACCEPT'] ) );
319	294
320		- /**
321		- * Check if content negotiation is allowed for a request.
322		- *
323		- * @return bool True if content negotiation is allowed, false otherwise.
324		- */
325		- public function should_negotiate_content() {
326		- $return = false;
327		- $always_negotiate = array( 'p', 'c', 'author', 'actor', 'stamp', 'preview', 'activitypub' );
328		- $url = \wp_parse_url( $this->get_request_url(), PHP_URL_QUERY );
329		- $query = array();
330		- \wp_parse_str( $url, $query );
	295	+ /*
	296	+ * $accept can be a single value, or a comma separated list of values.
	297	+ * We want to support both scenarios,
	298	+ * and return true when the header includes at least one of the following:
	299	+ * - application/activity+json
	300	+ * - application/ld+json
	301	+ * - application/json
	302	+ */
	303	+ if ( \preg_match( '/(application\/(ld\+json|activity\+json|json))/i', $accept ) ) {
	304	+ \defined( 'ACTIVITYPUB_REQUEST' ) || \define( 'ACTIVITYPUB_REQUEST', true );
	305	+ $this->is_activitypub_request = true;
331	306
332		- // Check if any of the query params are in the `$always_negotiate` array.
333		- if ( \array_intersect( \array_keys( $query ), $always_negotiate ) ) {
334		- $return = true;
	307	+ return true;
	308	+ }
335	309	}
336	310
337		- if ( \get_option( 'activitypub_content_negotiation', '1' ) ) {
338		- $return = true;
339		- }
	311	+ $this->is_activitypub_request = false;
340	312
341		- if ( \is_author() && \get_user_option( 'activitypub_use_permalink_as_id', \get_queried_object_id() ) ) {
342		- $return = true;
343		- }
344		-
345		- /**
346		- * Filters whether content negotiation should be forced.
347		- *
348		- * @param bool $return Whether content negotiation should be forced.
349		- */
350		- return \apply_filters( 'activitypub_should_negotiate_content', $return );
	313	+ return false;
351	314	}
352	315
353	316	/**
354	317	* Check if the current request is from the old host.
		@@ -383,54 +346,6 @@
383	346	* @param bool $state Optional. The state to set. Default true.
384	347	*/
385	348	public function set_old_host_request( $state = true ) {
386	349	$this->is_old_host_request = $state;
387		- }
388		-
389		- /**
390		- * Maybe get a QuoteAuthorization object from a stamp.
391		- *
392		- * @return bool True if the object was prepared, false otherwise.
393		- */
394		- private function maybe_get_stamp() {
395		- require_once ABSPATH . 'wp-admin/includes/post.php';
396		-
397		- $stamp = \get_query_var( 'stamp' );
398		- $meta = \get_post_meta_by_id( (int) $stamp );
399		-
400		- if ( ! $meta ) {
401		- return false;
402		- }
403		-
404		- $post = $this->get_queried_object();
405		-
406		- // Ensure the meta belongs to the queried post to prevent arbitrary meta disclosure.
407		- if ( (int) $meta->post_id !== $post->ID ) {
408		- return false;
409		- }
410		-
411		- $user_uri = get_user_id( $post->post_author );
412		-
413		- if ( ! $user_uri ) {
414		- return false;
415		- }
416		-
417		- $stamp_uri = \add_query_arg(
418		- array(
419		- 'p' => $post->ID,
420		- 'stamp' => $meta->meta_id,
421		- ),
422		- \home_url( '/' )
423		- );
424		-
425		- $activitypub_object = new Quote_Authorization();
426		- $activitypub_object->set_id( $stamp_uri );
427		- $activitypub_object->set_attributed_to( $user_uri );
428		- $activitypub_object->set_interacting_object( $meta->meta_value );
429		- $activitypub_object->set_interaction_target( get_post_id( $post->ID ) );
430		-
431		- $this->activitypub_object = $activitypub_object;
432		- $this->activitypub_object_id = $activitypub_object->get_id();
433		-
434		- return true;
435	350	}
436	351	}