← All changes | includes/class-http.php +249 -46 1.2.0 → 8.0.2 View file →

		@@ -1,9 +1,14 @@
1	1	<?php
	2	+/**
	3	+ * ActivityPub HTTP Class.
	4	+ *
	5	+ * @package Activitypub
	6	+ */
	7	+
2	8	namespace Activitypub;
3	9
4		-use WP_Error;
5		-use Activitypub\Collection\Users;
	10	+use Activitypub\Collection\Actors;
6	11
7	12	/**
8	13	* ActivityPub HTTP Class
9	14	*
		@@ -12,42 +17,52 @@
12	17	class Http {
13	18	/**
14	19	* Send a POST Request with the needed HTTP Headers
15	20	*
16		- * @param string $url The URL endpoint
17		- * @param string $body The Post Body
18		- * @param int $user_id The WordPress User-ID
	21	+ * @param string $url The URL endpoint.
	22	+ * @param string $body The Post Body.
	23	+ * @param int $user_id The WordPress User-ID.
19	24	*
20		- * @return array|WP_Error The POST Response or an WP_ERROR
	25	+ * @return array|\WP_Error The POST Response or an WP_Error.
21	26	*/
22	27	public static function post( $url, $body, $user_id ) {
23		- do_action( 'activitypub_pre_http_post', $url, $body, $user_id );
	28	+ /**
	29	+ * Fires before an HTTP POST request is made.
	30	+ *
	31	+ * @param string $url The URL endpoint.
	32	+ * @param string $body The POST body.
	33	+ * @param int $user_id The WordPress User ID.
	34	+ */
	35	+ \do_action( 'activitypub_pre_http_post', $url, $body, $user_id );
24	36
25		- $date = \gmdate( 'D, d M Y H:i:s T' );
26		- $digest = Signature::generate_digest( $body );
27		- $signature = Signature::generate_signature( $user_id, 'post', $url, $date, $digest );
	37	+ /**
	38	+ * Filters the HTTP headers user agent string.
	39	+ *
	40	+ * @param string $user_agent The user agent string.
	41	+ */
	42	+ $user_agent = \apply_filters( 'http_headers_useragent', 'WordPress/' . get_masked_wp_version() . '; ' . \get_bloginfo( 'url' ) );
28	43
29		- $wp_version = \get_bloginfo( 'version' );
30		-
31	44	/**
32		- * Filter the HTTP headers user agent.
	45	+ * Filters the timeout duration for remote POST requests in ActivityPub.
33	46	*
34		- * @param string $user_agent The user agent string.
	47	+ * @param int $timeout The timeout value in seconds. Default 10 seconds.
35	48	*/
36		- $user_agent = \apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . \get_bloginfo( 'url' ) );
	49	+ $timeout = \apply_filters( 'activitypub_remote_post_timeout', 10 );
	50	+
37	51	$args = array(
38		- 'timeout' => 100,
	52	+ 'timeout' => $timeout,
39	53	'limit_response_size' => 1048576,
40		- 'redirection' => 3,
41		- 'user-agent' => "$user_agent; ActivityPub",
42		- 'headers' => array(
43		- 'Accept' => 'application/activity+json',
	54	+ 'redirection' => 3,
	55	+ 'user-agent' => "$user_agent; ActivityPub",
	56	+ 'headers' => array(
	57	+ 'Accept' => 'application/activity+json',
44	58	'Content-Type' => 'application/activity+json',
45		- 'Digest' => $digest,
46		- 'Signature' => $signature,
47		- 'Date' => $date,
	59	+ 'Date' => \gmdate( 'D, d M Y H:i:s T' ),
48	60	),
49		- 'body' => $body,
	61	+ 'body' => $body,
	62	+ 'key_id' => \json_decode( $body )->actor . '#main-key',
	63	+ 'private_key' => Actors::get_private_key( $user_id ),
	64	+ 'user_id' => $user_id,
50	65	);
51	66
52	67	$response = \wp_safe_remote_post( $url, $args );
53	68	$code = \wp_remote_retrieve_response_code( $response );
		@@ -52,11 +67,26 @@
52	67	$response = \wp_safe_remote_post( $url, $args );
53	68	$code = \wp_remote_retrieve_response_code( $response );
54	69
55	70	if ( $code >= 400 ) {
56		- $response = new WP_Error( $code, __( 'Failed HTTP Request', 'activitypub' ), array( 'status' => $code ) );
	71	+ $response = new \WP_Error(
	72	+ $code,
	73	+ __( 'Failed HTTP Request', 'activitypub' ),
	74	+ array(
	75	+ 'status' => $code,
	76	+ 'response' => $response,
	77	+ )
	78	+ );
57	79	}
58	80
	81	+ /**
	82	+ * Action to save the response of the remote POST request.
	83	+ *
	84	+ * @param array|\WP_Error $response The response of the remote POST request.
	85	+ * @param string $url The URL endpoint.
	86	+ * @param string $body The Post Body.
	87	+ * @param int $user_id The WordPress User-ID.
	88	+ */
59	89	\do_action( 'activitypub_safe_remote_post_response', $response, $url, $body, $user_id );
60	90
61	91	return $response;
62	92	}
		@@ -61,51 +91,224 @@
61	91	return $response;
62	92	}
63	93
64	94	/**
65		- * Send a GET Request with the needed HTTP Headers
	95	+ * Send a GET Request with the needed HTTP Headers.
66	96	*
67		- * @param string $url The URL endpoint
68		- * @param int $user_id The WordPress User-ID
	97	+ * @param string $url The URL endpoint.
	98	+ * @param array $args Optional. Additional arguments to customize the request.
	99	+ * - 'headers': Array of headers to override defaults.
	100	+ * @param bool|int $cached Optional. Whether to return cached results, or cache duration. Default false.
69	101	*
70		- * @return array|WP_Error The GET Response or an WP_ERROR
	102	+ * @return array|\WP_Error The GET Response or a WP_Error.
71	103	*/
72		- public static function get( $url ) {
73		- do_action( 'activitypub_pre_http_get', $url );
	104	+ public static function get( $url, $args = array(), $cached = false ) {
	105	+ // Backward compatibility: if $args is boolean/int, it's the old $cached parameter.
	106	+ if ( ! \is_array( $args ) ) {
	107	+ \_deprecated_argument(
	108	+ __METHOD__,
	109	+ '7.9.0',
	110	+ \esc_html__( 'The $cached parameter should now be passed as the third argument.', 'activitypub' )
	111	+ );
	112	+ $cached = $args;
	113	+ $args = array();
	114	+ }
74	115
75		- $date = \gmdate( 'D, d M Y H:i:s T' );
76		- $signature = Signature::generate_signature( Users::APPLICATION_USER_ID, 'get', $url, $date );
	116	+ /**
	117	+ * Fires before an HTTP GET request is made.
	118	+ *
	119	+ * @param string $url The URL endpoint.
	120	+ */
	121	+ \do_action( 'activitypub_pre_http_get', $url );
77	122
78		- $wp_version = \get_bloginfo( 'version' );
	123	+ $transient_key = self::generate_cache_key( $url );
79	124
	125	+ // Check cache only if caching is requested.
	126	+ if ( $cached ) {
	127	+ $response = \get_transient( $transient_key );
	128	+
	129	+ if ( $response ) {
	130	+ /**
	131	+ * Action to save the response of the remote GET request.
	132	+ *
	133	+ * @param array|\WP_Error $response The response of the remote GET request.
	134	+ * @param string $url The URL endpoint.
	135	+ */
	136	+ \do_action( 'activitypub_safe_remote_get_response', $response, $url );
	137	+
	138	+ return $response;
	139	+ }
	140	+ }
	141	+
80	142	/**
81		- * Filter the HTTP headers user agent.
	143	+ * Filters the HTTP headers user agent string.
82	144	*
	145	+ * This filter allows developers to modify the user agent string that is
	146	+ * sent with HTTP requests.
	147	+ *
83	148	* @param string $user_agent The user agent string.
84	149	*/
85		- $user_agent = \apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . \get_bloginfo( 'url' ) );
	150	+ $user_agent = \apply_filters( 'http_headers_useragent', 'WordPress/' . get_masked_wp_version() . '; ' . \get_bloginfo( 'url' ) );
86	151
87		- $args = array(
88		- 'timeout' => apply_filters( 'activitypub_remote_get_timeout', 100 ),
	152	+ /**
	153	+ * Filters the timeout duration for remote GET requests in ActivityPub.
	154	+ *
	155	+ * @param int $timeout The timeout value in seconds. Default 10 seconds.
	156	+ */
	157	+ $timeout = \apply_filters( 'activitypub_remote_get_timeout', 10 );
	158	+
	159	+ $defaults = array(
	160	+ 'timeout' => $timeout,
89	161	'limit_response_size' => 1048576,
90		- 'redirection' => 3,
91		- 'user-agent' => "$user_agent; ActivityPub",
92		- 'headers' => array(
93		- 'Accept' => 'application/activity+json',
	162	+ 'redirection' => 3,
	163	+ 'user-agent' => "$user_agent; ActivityPub",
	164	+ 'headers' => array(
	165	+ 'Accept' => 'application/activity+json',
94	166	'Content-Type' => 'application/activity+json',
95		- 'Signature' => $signature,
96		- 'Date' => $date,
	167	+ 'Date' => \gmdate( 'D, d M Y H:i:s T' ),
97	168	),
	169	+ 'key_id' => Actors::get_by_id( Actors::APPLICATION_USER_ID )->get_id() . '#main-key',
	170	+ 'private_key' => Actors::get_private_key( Actors::APPLICATION_USER_ID ),
98	171	);
99	172
	173	+ $args = \wp_parse_args( $args, $defaults );
	174	+ $args['headers'] = \wp_parse_args( $args['headers'], $defaults['headers'] );
	175	+
100	176	$response = \wp_safe_remote_get( $url, $args );
101	177	$code = \wp_remote_retrieve_response_code( $response );
102	178
103		- if ( $code >= 400 ) {
104		- $response = new WP_Error( $code, __( 'Failed HTTP Request', 'activitypub' ), array( 'status' => $code ) );
	179	+ if ( \is_wp_error( $response ) || $code >= 400 ) {
	180	+ $response = new \WP_Error( $code, __( 'Failed HTTP Request', 'activitypub' ), array( 'status' => $code ) );
	181	+
	182	+ /*
	183	+ * Always cache errors to prevent repeated timeout waits.
	184	+ * - Retriable errors (timeouts, 5xx): 1 minute (server may recover quickly).
	185	+ * - Other errors (4xx): 15 minutes (client errors are more permanent).
	186	+ */
	187	+ if ( \in_array( $code, ACTIVITYPUB_RETRY_ERROR_CODES, true ) || 0 === $code ) {
	188	+ $cache_duration = MINUTE_IN_SECONDS;
	189	+ } else {
	190	+ $cache_duration = 15 * MINUTE_IN_SECONDS;
	191	+ }
	192	+
	193	+ \set_transient( $transient_key, $response, $cache_duration );
	194	+
	195	+ return $response;
105	196	}
106	197
	198	+ /**
	199	+ * Action to save the response of the remote GET request.
	200	+ *
	201	+ * @param array|\WP_Error $response The response of the remote GET request.
	202	+ * @param string $url The URL endpoint.
	203	+ */
107	204	\do_action( 'activitypub_safe_remote_get_response', $response, $url );
108	205
	206	+ // Always cache successful responses.
	207	+ $cache_duration = $cached;
	208	+ if ( ! is_int( $cache_duration ) ) {
	209	+ $cache_duration = HOUR_IN_SECONDS;
	210	+ }
	211	+ \set_transient( $transient_key, $response, $cache_duration );
	212	+
109	213	return $response;
	214	+ }
	215	+
	216	+ /**
	217	+ * Check for URL for Tombstone.
	218	+ *
	219	+ * @param string $url The URL to check.
	220	+ *
	221	+ * @return bool True if the URL is a tombstone.
	222	+ */
	223	+ public static function is_tombstone( $url ) {
	224	+ _deprecated_function( __METHOD__, '7.3.0', 'Activitypub\Tombstone::exists_remote' );
	225	+
	226	+ return Tombstone::exists_remote( $url );
	227	+ }
	228	+
	229	+ /**
	230	+ * Generate a cache key for the URL.
	231	+ *
	232	+ * @param string $url The URL to generate the cache key for.
	233	+ *
	234	+ * @return string The cache key.
	235	+ */
	236	+ public static function generate_cache_key( $url ) {
	237	+ return 'activitypub_http_' . \md5( $url );
	238	+ }
	239	+
	240	+ /**
	241	+ * Requests the Data from the Object-URL or Object-Array.
	242	+ *
	243	+ * @param array|string $url_or_object The Object or the Object URL.
	244	+ * @param bool $cached Optional. Whether the result should be cached. Default true.
	245	+ *
	246	+ * @return array|\WP_Error The Object data as array or WP_Error on failure.
	247	+ */
	248	+ public static function get_remote_object( $url_or_object, $cached = true ) {
	249	+ /**
	250	+ * Filters the preemptive return value of a remote object request.
	251	+ *
	252	+ * @param array|string|null $response The response.
	253	+ * @param array|string|null $url_or_object The Object or the Object URL.
	254	+ */
	255	+ $response = apply_filters( 'activitypub_pre_http_get_remote_object', null, $url_or_object );
	256	+ if ( null !== $response ) {
	257	+ return $response;
	258	+ }
	259	+
	260	+ $url = object_to_uri( $url_or_object );
	261	+
	262	+ if ( preg_match( '/^@?' . ACTIVITYPUB_USERNAME_REGEXP . '$/i', $url ) ) {
	263	+ $url = Webfinger::resolve( $url );
	264	+ }
	265	+
	266	+ if ( ! $url ) {
	267	+ return new \WP_Error(
	268	+ 'activitypub_no_valid_actor_identifier',
	269	+ \__( 'The "actor" identifier is not valid', 'activitypub' ),
	270	+ array(
	271	+ 'status' => 404,
	272	+ 'object' => $url,
	273	+ )
	274	+ );
	275	+ }
	276	+
	277	+ if ( \is_wp_error( $url ) ) {
	278	+ return $url;
	279	+ }
	280	+
	281	+ if ( ! \wp_http_validate_url( $url ) ) {
	282	+ return new \WP_Error(
	283	+ 'activitypub_no_valid_object_url',
	284	+ \__( 'The "object" is/has no valid URL', 'activitypub' ),
	285	+ array(
	286	+ 'status' => 400,
	287	+ 'object' => $url,
	288	+ )
	289	+ );
	290	+ }
	291	+
	292	+ $response = self::get( $url, array(), $cached );
	293	+
	294	+ if ( \is_wp_error( $response ) ) {
	295	+ return $response;
	296	+ }
	297	+
	298	+ $data = \wp_remote_retrieve_body( $response );
	299	+ $data = \json_decode( $data, true );
	300	+
	301	+ if ( ! $data ) {
	302	+ return new \WP_Error(
	303	+ 'activitypub_invalid_json',
	304	+ \__( 'No valid JSON data', 'activitypub' ),
	305	+ array(
	306	+ 'status' => 400,
	307	+ 'object' => $url,
	308	+ )
	309	+ );
	310	+ }
	311	+
	312	+ return $data;
110	313	}
111	314	}