← All changes | includes/class-router.php +7 -63 8.2.0 → 7.8.2 View file →

		@@ -19,9 +19,8 @@
19	19	*/
20	20	public static function init() {
21	21	\add_action( 'init', array( self::class, 'add_rewrite_rules' ), 11 );
22	22
23		- \add_action( 'send_headers', array( self::class, 'add_headers' ) );
24	23	\add_filter( 'template_include', array( self::class, 'render_activitypub_template' ), 99 );
25	24	\add_action( 'template_redirect', array( self::class, 'template_redirect' ) );
26	25	\add_filter( 'redirect_canonical', array( self::class, 'redirect_canonical' ), 10, 2 );
27	26	\add_filter( 'redirect_canonical', array( self::class, 'no_trailing_redirect' ), 10, 2 );
		@@ -41,14 +40,8 @@
41	40	if ( ACTIVITYPUB_DISABLE_REWRITES ) {
42	41	return;
43	42	}
44	43
45		- \add_rewrite_rule(
46		- '^authorize_interaction/?$',
47		- 'index.php?rest_route=/' . ACTIVITYPUB_REST_NAMESPACE . '/interactions',
48		- 'top'
49		- );
50		-
51	44	if ( ! \class_exists( 'Webfinger' ) ) {
52	45	\add_rewrite_rule(
53	46	'^.well-known/webfinger',
54	47	'index.php?rest_route=/' . ACTIVITYPUB_REST_NAMESPACE . '/webfinger',
		@@ -63,15 +56,8 @@
63	56	'top'
64	57	);
65	58	}
66	59
67		- // Authorization Server Metadata (RFC 8414).
68		- \add_rewrite_rule(
69		- '^.well-known/oauth-authorization-server',
70		- 'index.php?rest_route=/' . ACTIVITYPUB_REST_NAMESPACE . '/oauth/authorization-server-metadata',
71		- 'top'
72		- );
73		-
74	60	\add_rewrite_rule( '^@([\w\-\.]+)\/?$', 'index.php?actor=$matches[1]', 'top' );
75	61	\add_rewrite_endpoint( 'activitypub', EP_AUTHORS | EP_PERMALINK | EP_PAGES );
76	62	}
77	63
		@@ -86,39 +72,25 @@
86	72	if ( \wp_is_serving_rest_request() || \wp_doing_ajax() ) {
87	73	return $template;
88	74	}
89	75
	76	+ self::add_headers();
	77	+
90	78	if ( ! is_activitypub_request() || ! should_negotiate_content() ) {
91		- $is_outbox_item = \get_query_var( 'p' ) && Outbox::POST_TYPE === \get_post_type( \get_query_var( 'p' ) );
92		- $is_preflight = isset( $_SERVER['REQUEST_METHOD'] ) && 'OPTIONS' === $_SERVER['REQUEST_METHOD'];
93		-
94		- if ( $is_outbox_item && $is_preflight ) {
95		- /*
96		- * CORS preflight: override WordPress 404 so the browser
97		- * accepts the preflight response (must be 2xx).
98		- */
99		- \status_header( 200 );
100		- } elseif ( $is_outbox_item ) {
101		- // Return 406 for non-ActivityPub requests to outbox items since they only support ActivityPub requests.
	79	+ if ( \get_query_var( 'p' ) && Outbox::POST_TYPE === \get_post_type( \get_query_var( 'p' ) ) ) {
102	80	\set_query_var( 'is_404', true );
103	81	\status_header( 406 );
104	82	}
105		-
106	83	return $template;
107	84	}
108	85
109		- $activitypub_object = Query::get_instance()->get_activitypub_object();
110		-
111	86	if ( Tombstone::exists_local( Query::get_instance()->get_request_url() ) ) {
112		- // Set 410 Gone for permanently deleted posts, 200 OK for soft-deleted.
113		- if ( ! $activitypub_object ) {
114		- \status_header( 410 );
115		- }
116		-
	87	+ \status_header( 410 );
117	88	return ACTIVITYPUB_PLUGIN_DIR . 'templates/tombstone-json.php';
118	89	}
119	90
120	91	$activitypub_template = false;
	92	+ $activitypub_object = Query::get_instance()->get_activitypub_object();
121	93
122	94	if ( $activitypub_object ) {
123	95	if ( \get_query_var( 'preview' ) ) {
124	96	\define( 'ACTIVITYPUB_PREVIEW', true );
		@@ -170,28 +142,13 @@
170	142	*/
171	143	public static function add_headers() {
172	144	$id = Query::get_instance()->get_activitypub_object_id();
173	145
174		- /*
175		- * Send CORS headers for resolved ActivityPub objects and outbox
176		- * items. Outbox items need CORS even when the object ID doesn't
177		- * resolve, because browser preflight requests don't carry the
178		- * Authorization header needed to authenticate private items.
179		- */
180		- $post_id = \get_query_var( 'p' );
181		- $is_outbox_url = $post_id && Outbox::POST_TYPE === \get_post_type( $post_id );
182		-
183		- if ( ! \headers_sent() && ( $id || $is_outbox_url ) ) {
184		- \header( 'Access-Control-Allow-Origin: *' );
185		- \header( 'Access-Control-Allow-Methods: GET, OPTIONS' );
186		- \header( 'Access-Control-Allow-Headers: Accept, Authorization, Content-Type' );
187		- }
188		-
189	146	if ( ! $id ) {
190	147	return;
191	148	}
192	149
193		- if ( ! \headers_sent() ) {
	150	+ if ( ! headers_sent() ) {
194	151	\header( 'Link: <' . esc_url( $id ) . '>; title="ActivityPub (JSON)"; rel="alternate"; type="application/activity+json"', false );
195	152
196	153	if ( \get_option( 'activitypub_vary_header', '1' ) ) {
197	154	// Send Vary header for Accept header.
		@@ -198,9 +155,9 @@
198	155	\header( 'Vary: Accept', false );
199	156	}
200	157	}
201	158
202		- \add_action(
	159	+ add_action(
203	160	'wp_head',
204	161	static function () use ( $id ) {
205	162	echo PHP_EOL . '<link rel="alternate" title="ActivityPub (JSON)" type="application/activity+json" href="' . esc_url( $id ) . '" />' . PHP_EOL;
206	163	}
		@@ -312,21 +269,8 @@
312	269
313	270	// Load a 404-page if `term_id` is set but not valid.
314	271	if ( ! $term || \is_wp_error( $term ) ) {
315	272	$wp_query->set_404();
316		- return;
317		- }
318		-
319		- /**
320		- * Filters the taxonomies supported for term redirects.
321		- *
322		- * @since 7.8.3
323		- *
324		- * @param array $supported_taxonomies Array of taxonomy names. Default array( 'category', 'post_tag' ).
325		- */
326		- $supported_taxonomies = \apply_filters( 'activitypub_supported_taxonomies', array( 'category', 'post_tag' ) );
327		-
328		- if ( ! in_array( $term->taxonomy, $supported_taxonomies, true ) ) {
329	273	return;
330	274	}
331	275
332	276	// Don't redirect for ActivityPub requests.