| @@ -6,13 +6,11 @@ | ||
| 6 | 6 | */ |
| 7 | 7 | |
| 8 | 8 | namespace Activitypub; |
| 9 | 9 | |
| 10 | -use Activitypub\Activity\Extended_Object\Feature_Authorization; | |
| 11 | 10 | use Activitypub\Activity\Extended_Object\Quote_Authorization; |
| 12 | 11 | use Activitypub\Collection\Actors; |
| 13 | 12 | use Activitypub\Collection\Outbox; |
| 14 | -use Activitypub\Handler\Feature_Request; | |
| 15 | 13 | use Activitypub\Transformer\Factory; |
| 16 | 14 | |
| 17 | 15 | /** |
| 18 | 16 | * Singleton class to handle and store the ActivityPub query. |
| @@ -140,17 +138,10 @@ | ||
| 140 | 138 | */ |
| 141 | 139 | private function prepare_activitypub_data() { |
| 142 | 140 | $queried_object = $this->get_queried_object(); |
| 143 | 141 | |
| 144 | - if ( \get_query_var( 'stamp' ) ) { | |
| 145 | - if ( $queried_object instanceof \WP_Post ) { | |
| 146 | - return $this->maybe_get_stamp(); | |
| 147 | - } | |
| 148 | - | |
| 149 | - // Note: the blog actor's `actor` query var is '0', which is falsy but valid. | |
| 150 | - if ( $queried_object instanceof \WP_User || '' !== \get_query_var( 'actor' ) ) { | |
| 151 | - return $this->maybe_get_actor_stamp(); | |
| 152 | - } | |
| 142 | + if ( $queried_object instanceof \WP_Post && \get_query_var( 'stamp' ) ) { | |
| 143 | + return $this->maybe_get_stamp(); | |
| 153 | 144 | } |
| 154 | 145 | |
| 155 | 146 | // Check for Outbox Activity. |
| 156 | 147 | if ( |
| @@ -409,20 +400,9 @@ | ||
| 409 | 400 | if ( ! $meta ) { |
| 410 | 401 | return false; |
| 411 | 402 | } |
| 412 | 403 | |
| 413 | - $post = $this->get_queried_object(); | |
| 414 | - | |
| 415 | - /* | |
| 416 | - * Only quote-authorization meta may be reflected as a stamp, and only for the queried | |
| 417 | - * post. Checking the post id alone would still let an unauthenticated request read any | |
| 418 | - * of that post's meta rows (e.g. _edit_lock or private custom fields) by guessing a | |
| 419 | - * meta_id, so the meta key is verified too. | |
| 420 | - */ | |
| 421 | - if ( '_activitypub_quoted_by' !== $meta->meta_key || (int) $meta->post_id !== $post->ID ) { | |
| 422 | - return false; | |
| 423 | - } | |
| 424 | - | |
| 404 | + $post = $this->get_queried_object(); | |
| 425 | 405 | $user_uri = get_user_id( $post->post_author ); |
| 426 | 406 | |
| 427 | 407 | if ( ! $user_uri ) { |
| 428 | 408 | return false; |
| @@ -443,73 +423,8 @@ | ||
| 443 | 423 | $activitypub_object->set_interaction_target( get_post_id( $post->ID ) ); |
| 444 | 424 | |
| 445 | 425 | $this->activitypub_object = $activitypub_object; |
| 446 | 426 | $this->activitypub_object_id = $activitypub_object->get_id(); |
| 447 | - | |
| 448 | - return true; | |
| 449 | - } | |
| 450 | - | |
| 451 | - /** | |
| 452 | - * Maybe get a FeatureAuthorization object from an actor-scoped stamp. | |
| 453 | - * | |
| 454 | - * Resolves URLs of the form `?actor=USER_ID&stamp=STAMP_ID` against the | |
| 455 | - * actor's stamp store, see {@see Feature_Request::get_stamp()}. Ownership | |
| 456 | - * is enforced by resolving the stamp scoped to the queried actor, which | |
| 457 | - * includes the blog actor (`actor=0`). | |
| 458 | - * | |
| 459 | - * @return bool True if a FeatureAuthorization was prepared, false otherwise. | |
| 460 | - */ | |
| 461 | - private function maybe_get_actor_stamp() { | |
| 462 | - $stamp_id = (int) \get_query_var( 'stamp' ); | |
| 463 | - $actor_var = \get_query_var( 'actor' ); | |
| 464 | - | |
| 465 | - if ( ! $stamp_id ) { | |
| 466 | - return false; | |
| 467 | - } | |
| 468 | - | |
| 469 | - if ( '' === $actor_var ) { | |
| 470 | - $queried = $this->get_queried_object(); | |
| 471 | - if ( ! $queried instanceof \WP_User ) { | |
| 472 | - return false; | |
| 473 | - } | |
| 474 | - | |
| 475 | - $actor_id = (int) $queried->ID; | |
| 476 | - } else { | |
| 477 | - // Values like '0e1' or '1.5' pass is_numeric() but cast to 0/1 and alias | |
| 478 | - // an actor, so require a plain decimal integer before casting. | |
| 479 | - if ( ! \ctype_digit( (string) $actor_var ) ) { | |
| 480 | - return false; | |
| 481 | - } | |
| 482 | - | |
| 483 | - $actor_id = (int) $actor_var; | |
| 484 | - } | |
| 485 | - | |
| 486 | - $instrument = Feature_Request::get_stamp( $actor_id, $stamp_id ); | |
| 487 | - if ( null === $instrument ) { | |
| 488 | - return false; | |
| 489 | - } | |
| 490 | - | |
| 491 | - $actor = Actors::get_by_id( $actor_id ); | |
| 492 | - if ( \is_wp_error( $actor ) ) { | |
| 493 | - return false; | |
| 494 | - } | |
| 495 | - | |
| 496 | - $stamp_url = \add_query_arg( | |
| 497 | - array( | |
| 498 | - 'actor' => $actor_id, | |
| 499 | - 'stamp' => $stamp_id, | |
| 500 | - ), | |
| 501 | - \home_url( '/' ) | |
| 502 | - ); | |
| 503 | - | |
| 504 | - $authorization = new Feature_Authorization(); | |
| 505 | - $authorization->set_id( $stamp_url ); | |
| 506 | - $authorization->set_attributed_to( $actor->get_id() ); | |
| 507 | - $authorization->set_interacting_object( $instrument ); | |
| 508 | - $authorization->set_interaction_target( $actor->get_id() ); | |
| 509 | - | |
| 510 | - $this->activitypub_object = $authorization; | |
| 511 | - $this->activitypub_object_id = $authorization->get_id(); | |
| 512 | 427 | |
| 513 | 428 | return true; |
| 514 | 429 | } |
| 515 | 430 | } |
