| @@ -10,9 +10,8 @@ | ||
| 10 | 10 | use Activitypub\Collection\Following; |
| 11 | 11 | use Activitypub\Collection\Outbox; |
| 12 | 12 | use Activitypub\Collection\Remote_Actors; |
| 13 | 13 | |
| 14 | -use function Activitypub\is_same_actor; | |
| 15 | 14 | use function Activitypub\object_to_uri; |
| 16 | 15 | |
| 17 | 16 | /** |
| 18 | 17 | * Handle Accept requests. |
| @@ -42,24 +41,15 @@ | ||
| 42 | 41 | ) { |
| 43 | 42 | return; |
| 44 | 43 | } |
| 45 | 44 | |
| 46 | - /* | |
| 47 | - * For a Follow Accept, the sender must be the actor that was followed. | |
| 48 | - * Without this, a signed Accept from one actor could confirm a Follow that | |
| 49 | - * targeted another actor by referencing that pending Follow's outbox GUID. | |
| 50 | - */ | |
| 51 | - if ( ! is_same_actor( $accept['actor'] ?? '', $accept['object']['object'] ?? '' ) ) { | |
| 52 | - return; | |
| 53 | - } | |
| 45 | + $actor_post = Remote_Actors::get_by_uri( object_to_uri( $accept['object']['object'] ) ); | |
| 54 | 46 | |
| 55 | - $actor_post = Remote_Actors::get_by_uri( object_to_uri( $accept['object']['object'] ?? '' ) ); | |
| 56 | - | |
| 57 | 47 | if ( \is_wp_error( $actor_post ) ) { |
| 58 | 48 | return; |
| 59 | 49 | } |
| 60 | 50 | |
| 61 | - $user_id = \is_array( $user_ids ) ? \reset( $user_ids ) : $user_ids; | |
| 51 | + $user_id = is_array( $user_ids ) ? reset( $user_ids ) : $user_ids; | |
| 62 | 52 | $result = Following::accept( $actor_post, $user_id ); |
| 63 | 53 | $success = ! \is_wp_error( $result ); |
| 64 | 54 | |
| 65 | 55 | /** |
