| @@ -19,9 +19,8 @@ | ||
| 19 | 19 | */ |
| 20 | 20 | public static function init() { |
| 21 | 21 | \add_action( 'init', array( self::class, 'add_rewrite_rules' ), 11 ); |
| 22 | 22 | |
| 23 | - \add_action( 'send_headers', array( self::class, 'add_headers' ) ); | |
| 24 | 23 | \add_filter( 'template_include', array( self::class, 'render_activitypub_template' ), 99 ); |
| 25 | 24 | \add_action( 'template_redirect', array( self::class, 'template_redirect' ) ); |
| 26 | 25 | \add_filter( 'redirect_canonical', array( self::class, 'redirect_canonical' ), 10, 2 ); |
| 27 | 26 | \add_filter( 'redirect_canonical', array( self::class, 'no_trailing_redirect' ), 10, 2 ); |
| @@ -63,15 +62,8 @@ | ||
| 63 | 62 | 'top' |
| 64 | 63 | ); |
| 65 | 64 | } |
| 66 | 65 | |
| 67 | - // Authorization Server Metadata (RFC 8414). | |
| 68 | - \add_rewrite_rule( | |
| 69 | - '^.well-known/oauth-authorization-server', | |
| 70 | - 'index.php?rest_route=/' . ACTIVITYPUB_REST_NAMESPACE . '/oauth/authorization-server-metadata', | |
| 71 | - 'top' | |
| 72 | - ); | |
| 73 | - | |
| 74 | 66 | \add_rewrite_rule( '^@([\w\-\.]+)\/?$', 'index.php?actor=$matches[1]', 'top' ); |
| 75 | 67 | \add_rewrite_endpoint( 'activitypub', EP_AUTHORS | EP_PERMALINK | EP_PAGES ); |
| 76 | 68 | } |
| 77 | 69 | |
| @@ -86,24 +78,15 @@ | ||
| 86 | 78 | if ( \wp_is_serving_rest_request() || \wp_doing_ajax() ) { |
| 87 | 79 | return $template; |
| 88 | 80 | } |
| 89 | 81 | |
| 82 | + self::add_headers(); | |
| 83 | + | |
| 90 | 84 | if ( ! is_activitypub_request() || ! should_negotiate_content() ) { |
| 91 | - $is_outbox_item = \get_query_var( 'p' ) && Outbox::POST_TYPE === \get_post_type( \get_query_var( 'p' ) ); | |
| 92 | - $is_preflight = isset( $_SERVER['REQUEST_METHOD'] ) && 'OPTIONS' === $_SERVER['REQUEST_METHOD']; | |
| 93 | - | |
| 94 | - if ( $is_outbox_item && $is_preflight ) { | |
| 95 | - /* | |
| 96 | - * CORS preflight: override WordPress 404 so the browser | |
| 97 | - * accepts the preflight response (must be 2xx). | |
| 98 | - */ | |
| 99 | - \status_header( 200 ); | |
| 100 | - } elseif ( $is_outbox_item ) { | |
| 101 | - // Return 406 for non-ActivityPub requests to outbox items since they only support ActivityPub requests. | |
| 85 | + if ( \get_query_var( 'p' ) && Outbox::POST_TYPE === \get_post_type( \get_query_var( 'p' ) ) ) { | |
| 102 | 86 | \set_query_var( 'is_404', true ); |
| 103 | 87 | \status_header( 406 ); |
| 104 | 88 | } |
| 105 | - | |
| 106 | 89 | return $template; |
| 107 | 90 | } |
| 108 | 91 | |
| 109 | 92 | $activitypub_object = Query::get_instance()->get_activitypub_object(); |
| @@ -112,9 +95,8 @@ | ||
| 112 | 95 | // Set 410 Gone for permanently deleted posts, 200 OK for soft-deleted. |
| 113 | 96 | if ( ! $activitypub_object ) { |
| 114 | 97 | \status_header( 410 ); |
| 115 | 98 | } |
| 116 | - | |
| 117 | 99 | return ACTIVITYPUB_PLUGIN_DIR . 'templates/tombstone-json.php'; |
| 118 | 100 | } |
| 119 | 101 | |
| 120 | 102 | $activitypub_template = false; |
| @@ -170,28 +152,13 @@ | ||
| 170 | 152 | */ |
| 171 | 153 | public static function add_headers() { |
| 172 | 154 | $id = Query::get_instance()->get_activitypub_object_id(); |
| 173 | 155 | |
| 174 | - /* | |
| 175 | - * Send CORS headers for resolved ActivityPub objects and outbox | |
| 176 | - * items. Outbox items need CORS even when the object ID doesn't | |
| 177 | - * resolve, because browser preflight requests don't carry the | |
| 178 | - * Authorization header needed to authenticate private items. | |
| 179 | - */ | |
| 180 | - $post_id = \get_query_var( 'p' ); | |
| 181 | - $is_outbox_url = $post_id && Outbox::POST_TYPE === \get_post_type( $post_id ); | |
| 182 | - | |
| 183 | - if ( ! \headers_sent() && ( $id || $is_outbox_url ) ) { | |
| 184 | - \header( 'Access-Control-Allow-Origin: *' ); | |
| 185 | - \header( 'Access-Control-Allow-Methods: GET, OPTIONS' ); | |
| 186 | - \header( 'Access-Control-Allow-Headers: Accept, Authorization, Content-Type' ); | |
| 187 | - } | |
| 188 | - | |
| 189 | 156 | if ( ! $id ) { |
| 190 | 157 | return; |
| 191 | 158 | } |
| 192 | 159 | |
| 193 | - if ( ! \headers_sent() ) { | |
| 160 | + if ( ! headers_sent() ) { | |
| 194 | 161 | \header( 'Link: <' . esc_url( $id ) . '>; title="ActivityPub (JSON)"; rel="alternate"; type="application/activity+json"', false ); |
| 195 | 162 | |
| 196 | 163 | if ( \get_option( 'activitypub_vary_header', '1' ) ) { |
| 197 | 164 | // Send Vary header for Accept header. |
| @@ -198,9 +165,9 @@ | ||
| 198 | 165 | \header( 'Vary: Accept', false ); |
| 199 | 166 | } |
| 200 | 167 | } |
| 201 | 168 | |
| 202 | - \add_action( | |
| 169 | + add_action( | |
| 203 | 170 | 'wp_head', |
| 204 | 171 | static function () use ( $id ) { |
| 205 | 172 | echo PHP_EOL . '<link rel="alternate" title="ActivityPub (JSON)" type="application/activity+json" href="' . esc_url( $id ) . '" />' . PHP_EOL; |
| 206 | 173 | } |
