| @@ -30,26 +30,9 @@ | ||
| 30 | 30 | * @param int|int[]|null $user_ids The user ID(s). |
| 31 | 31 | */ |
| 32 | 32 | public static function handle_undo( $activity, $user_ids ) { |
| 33 | 33 | $success = false; |
| 34 | - | |
| 35 | - /* | |
| 36 | - * Resolve the sender so Inbox::undo() can verify ownership. A genuinely absent actor | |
| 37 | - * maps to null (no ownership check, for programmatic callers), but an actor that is | |
| 38 | - * present yet unparseable must be rejected rather than skipping the check — passing | |
| 39 | - * null there would re-open the undo-by-id attack. | |
| 40 | - */ | |
| 41 | - $actor = isset( $activity['actor'] ) ? object_to_uri( $activity['actor'] ) : null; | |
| 42 | - | |
| 43 | - if ( isset( $activity['actor'] ) && empty( $actor ) ) { | |
| 44 | - $result = new \WP_Error( | |
| 45 | - 'activitypub_undo_invalid_actor', | |
| 46 | - \__( 'The Undo activity has an invalid actor.', 'activitypub' ), | |
| 47 | - array( 'status' => 400 ) | |
| 48 | - ); | |
| 49 | - } else { | |
| 50 | - $result = Inbox_Collection::undo( object_to_uri( $activity['object'] ), $actor ); | |
| 51 | - } | |
| 34 | + $result = Inbox_Collection::undo( object_to_uri( $activity['object'] ) ); | |
| 52 | 35 | |
| 53 | 36 | if ( $result && ! \is_wp_error( $result ) ) { |
| 54 | 37 | $success = true; |
| 55 | 38 | } |
