← All changes | includes/rest/class-server.php +57 -53 8.2.0 → 7.8.2 View file →

		@@ -6,8 +6,12 @@
6	6	*/
7	7
8	8	namespace Activitypub\Rest;
9	9
	10	+use Activitypub\Signature;
	11	+
	12	+use function Activitypub\use_authorized_fetch;
	13	+
10	14	/**
11	15	* ActivityPub Server REST-Class.
12	16	*
13	17	* @author Django Doucet
		@@ -22,12 +26,64 @@
22	26	\add_filter( 'rest_request_before_callbacks', array( self::class, 'validate_requests' ), 9, 3 );
23	27	\add_filter( 'rest_request_parameter_order', array( self::class, 'request_parameter_order' ), 10, 2 );
24	28
25	29	\add_filter( 'rest_post_dispatch', array( self::class, 'filter_output' ), 10, 3 );
26		- \add_filter( 'rest_post_dispatch', array( self::class, 'add_cors_headers' ), 10, 3 );
27	30	}
28	31
29	32	/**
	33	+ * Callback function to authorize an api request.
	34	+ *
	35	+ * The function is meant to be used as part of permission callbacks for rest api endpoints.
	36	+ *
	37	+ * It verifies the signature of POST, PUT, PATCH, and DELETE requests, as well as GET requests in secure mode.
	38	+ * You can use the filter 'activitypub_defer_signature_verification' to defer the signature verification.
	39	+ * HEAD requests are always bypassed.
	40	+ *
	41	+ * @see https://www.w3.org/wiki/SocialCG/ActivityPub/Primer/Authentication_Authorization#Authorized_fetch
	42	+ * @see https://swicg.github.io/activitypub-http-signature/#authorized-fetch
	43	+ *
	44	+ * @param \WP_REST_Request $request The request object.
	45	+ *
	46	+ * @return bool|\WP_Error True if the request is authorized, WP_Error if not.
	47	+ */
	48	+ public static function verify_signature( $request ) {
	49	+ if ( 'HEAD' === $request->get_method() ) {
	50	+ return true;
	51	+ }
	52	+
	53	+ /**
	54	+ * Filter to defer signature verification.
	55	+ *
	56	+ * Skip signature verification for debugging purposes or to reduce load for
	57	+ * certain Activity-Types, like "Delete".
	58	+ *
	59	+ * @param bool $defer Whether to defer signature verification.
	60	+ * @param \WP_REST_Request $request The request used to generate the response.
	61	+ *
	62	+ * @return bool Whether to defer signature verification.
	63	+ */
	64	+ $defer = \apply_filters( 'activitypub_defer_signature_verification', false, $request );
	65	+
	66	+ if ( $defer ) {
	67	+ return true;
	68	+ }
	69	+
	70	+ // POST-Requests always have to be signed, GET-Requests only require a signature in secure mode.
	71	+ if ( 'GET' !== $request->get_method() || use_authorized_fetch() ) {
	72	+ $verified_request = Signature::verify_http_signature( $request );
	73	+ if ( \is_wp_error( $verified_request ) ) {
	74	+ return new \WP_Error(
	75	+ 'activitypub_signature_verification',
	76	+ $verified_request->get_error_message(),
	77	+ array( 'status' => 401 )
	78	+ );
	79	+ }
	80	+ }
	81	+
	82	+ return true;
	83	+ }
	84	+
	85	+ /**
30	86	* Callback function to validate incoming ActivityPub requests
31	87	*
32	88	* @param \WP_REST_Response|\WP_HTTP_Response|\WP_Error|mixed $response Result to send to the client.
33	89	* Usually a WP_REST_Response or WP_Error.
		@@ -121,13 +177,8 @@
121	177	if ( ! \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE ) ) {
122	178	return $response;
123	179	}
124	180
125		- // Exclude OAuth endpoints - they have their own error format per RFC 6749.
126		- if ( \str_starts_with( $route, '/' . ACTIVITYPUB_REST_NAMESPACE . '/oauth' ) ) {
127		- return $response;
128		- }
129		-
130	181	// Only alter responses that return an error status code.
131	182	if ( $response->get_status() < 400 ) {
132	183	return $response;
133	184	}
		@@ -156,53 +207,6 @@
156	207
157	208	$response->set_data( $error );
158	209
159	210	return $response;
160		- }
161		-
162		- /**
163		- * Add CORS headers to ActivityPub REST responses.
164		- *
165		- * @param \WP_REST_Response $response The REST response.
166		- * @param \WP_REST_Server $server The REST server instance.
167		- * @param \WP_REST_Request $request The request object.
168		- *
169		- * @return \WP_REST_Response The modified response.
170		- */
171		- public static function add_cors_headers( $response, $server, $request ) {
172		- $route = $request->get_route();
173		- $namespace = '/' . ACTIVITYPUB_REST_NAMESPACE;
174		-
175		- // Only add CORS to ActivityPub endpoints, except the interactive OAuth authorize endpoint.
176		- if ( ! \str_starts_with( $route, $namespace ) || \str_starts_with( $route, $namespace . '/oauth/authorize' ) ) {
177		- return $response;
178		- }
179		-
180		- /*
181		- * ActivityPub data is meant to be publicly readable by federation peers
182		- * and browser-side clients. We do not enable credentialed cross-origin
183		- * access: cookie auth would still be rejected by WordPress core's
184		- * REST nonce check, and OAuth Bearer tokens travel in the
185		- * Authorization header — which is permitted via Allow-Headers and
186		- * does not require Allow-Credentials.
187		- */
188		- $response->header( 'Access-Control-Allow-Origin', '*' );
189		- $response->header( 'Access-Control-Allow-Methods', 'GET, POST, OPTIONS' );
190		- $response->header( 'Access-Control-Allow-Headers', 'Accept, Content-Type, Authorization, Last-Event-ID' );
191		-
192		- return $response;
193		- }
194		-
195		- /**
196		- * Send CORS headers directly via header().
197		- *
198		- * Use this for endpoints that bypass the REST response flow
199		- * (e.g. SSE streams that call exit() instead of returning a WP_REST_Response).
200		- *
201		- * @since 8.1.0
202		- */
203		- public static function send_cors_headers() {
204		- \header( 'Access-Control-Allow-Origin: *' );
205		- \header( 'Access-Control-Allow-Methods: GET, POST, OPTIONS' );
206		- \header( 'Access-Control-Allow-Headers: Accept, Content-Type, Authorization, Last-Event-ID' );
207	211	}
208	212	}