← All changes | includes/handler/class-quote-request.php +11 -40 9.3.0 → 7.7.0 View file →

		@@ -13,11 +13,9 @@
13	13	use Activitypub\Collection\Inbox;
14	14	use Activitypub\Collection\Remote_Actors;
15	15
16	16	use function Activitypub\add_to_outbox;
17		-use function Activitypub\is_same_host;
18	17	use function Activitypub\object_to_uri;
19		-use function Activitypub\user_can_activitypub;
20	18
21	19	/**
22	20	* Handler for QuoteRequest activities.
23	21	*
		@@ -41,27 +39,21 @@
41	39	* @param array $activity The activity object.
42	40	* @param int|int[] $user_ids The user ID(s).
43	41	*/
44	42	public static function handle_quote_request( $activity, $user_ids ) {
	43	+ // Extract the user ID (quote requests are always for a single user).
	44	+ $user_id = \is_array( $user_ids ) ? \reset( $user_ids ) : $user_ids;
	45	+
45	46	$state = true;
46	47	$post_id = \url_to_postid( object_to_uri( $activity['object'] ) );
47		- $post = $post_id ? \get_post( $post_id ) : null;
48	48
49		- if ( ! $post ) {
50		- $user_id = \is_array( $user_ids ) ? \reset( $user_ids ) : $user_ids;
	49	+ if ( ! $post_id ) {
51	50	self::queue_reject( $activity, $user_id );
52	51	return;
53	52	}
54	53
55		- // Use the post author as the responding actor — they own the quoted content.
56		- $user_id = (int) $post->post_author;
57	54	$content_policy = \get_post_meta( $post_id, 'activitypub_interaction_policy_quote', true );
58	55
59		- // Fall back to global default if not set.
60		- if ( ! $content_policy ) {
61		- $content_policy = \get_option( 'activitypub_default_quote_policy', ACTIVITYPUB_INTERACTION_POLICY_ANYONE );
62		- }
63		-
64	56	switch ( $content_policy ) {
65	57	case ACTIVITYPUB_INTERACTION_POLICY_ME:
66	58	self::queue_reject( $activity, $user_id );
67	59	$state = false;
		@@ -99,9 +91,9 @@
99	91	* @param int|int[]|null $user_ids The user ID(s).
100	92	* @param string $type The type of the activity.
101	93	*/
102	94	public static function handle_blocked_request( $activity, $user_ids, $type ) {
103		- if ( ! \in_array( \strtolower( $type ), array( 'quoterequest', 'quote_request' ), true ) ) {
	95	+ if ( 'quoterequest' !== \strtolower( $type ) ) {
104	96	return;
105	97	}
106	98
107	99	// Extract the user ID (quote requests are always for a single user).
		@@ -115,19 +107,14 @@
115	107	*
116	108	* When a local quote comment is deleted, send a Reject activity to revoke
117	109	* the previously accepted QuoteRequest.
118	110	*
119		- * @param int $comment_id The comment ID being deleted.
120		- * @param \WP_Comment|null $comment The comment object, or null if not available.
	111	+ * @param int $comment_id The comment ID being deleted.
	112	+ * @param \WP_Comment $comment The comment object.
121	113	*/
122	114	public static function handle_quote_delete( $comment_id, $comment ) {
123		- // Try to get comment if not provided.
124		- if ( ! $comment ) {
125		- $comment = \get_comment( $comment_id );
126		- }
127		-
128	115	// Only handle quote comments.
129		- if ( ! $comment || 'quote' !== $comment->comment_type ) {
	116	+ if ( 'quote' !== $comment->comment_type ) {
130	117	return;
131	118	}
132	119
133	120	// Get the post being quoted.
		@@ -204,13 +191,8 @@
204	191	* @param int $user_id The user ID.
205	192	* @param int $post_id The post ID.
206	193	*/
207	194	public static function queue_accept( $activity_object, $user_id, $post_id ) {
208		- // Fall back to the blog actor if the user has ActivityPub disabled.
209		- if ( ! user_can_activitypub( $user_id ) ) {
210		- $user_id = Actors::BLOG_USER_ID;
211		- }
212		-
213	195	$actor = Actors::get_by_id( $user_id );
214	196
215	197	if ( \is_wp_error( $actor ) ) {
216	198	return;
		@@ -218,9 +200,9 @@
218	200
219	201	$activity_object['instrument'] = object_to_uri( $activity_object['instrument'] );
220	202
221	203	$post_meta = \get_post_meta( $post_id, '_activitypub_quoted_by', false );
222		- if ( \in_array( $activity_object['instrument'], $post_meta, true ) ) {
	204	+ if ( in_array( $activity_object['instrument'], $post_meta, true ) ) {
223	205	global $wpdb;
224	206
225	207	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
226	208	$meta_id = $wpdb->get_var(
		@@ -235,9 +217,9 @@
235	217	$meta_id = \add_post_meta( $post_id, '_activitypub_quoted_by', $activity_object['instrument'] );
236	218	}
237	219
238	220	// Only send minimal data.
239		- $activity_object = \array_intersect_key(
	221	+ $activity_object = array_intersect_key(
240	222	$activity_object,
241	223	array(
242	224	'id' => 1,
243	225	'type' => 1,
		@@ -273,13 +255,8 @@
273	255	* @param array $activity_object The activity object.
274	256	* @param int $user_id The user ID.
275	257	*/
276	258	public static function queue_reject( $activity_object, $user_id ) {
277		- // Fall back to the blog actor if the user has ActivityPub disabled.
278		- if ( ! user_can_activitypub( $user_id ) ) {
279		- $user_id = Actors::BLOG_USER_ID;
280		- }
281		-
282	259	$actor = Actors::get_by_id( $user_id );
283	260
284	261	if ( \is_wp_error( $actor ) ) {
285	262	return;
		@@ -287,9 +264,9 @@
287	264
288	265	$activity_object['instrument'] = object_to_uri( $activity_object['instrument'] );
289	266
290	267	// Only send minimal data.
291		- $activity_object = \array_intersect_key(
	268	+ $activity_object = array_intersect_key(
292	269	$activity_object,
293	270	array(
294	271	'id' => 1,
295	272	'type' => 1,
		@@ -328,14 +305,8 @@
328	305	return $valid;
329	306	}
330	307
331	308	if ( ! isset( $activity['actor'], $activity['object'], $activity['instrument'] ) ) {
332		- return false;
333		- }
334		-
335		- // The instrument is the quoting object, authored by the actor, so it must live on the
336		- // actor's host. Otherwise a remote server could bind a third-party reference to a local post.
337		- if ( ! is_same_host( $activity['actor'], $activity['instrument'] ) ) {
338	309	return false;
339	310	}
340	311
341	312	return $valid;