# activitypub/9.1.0/includes/handler/class-undo.php

ActivityPub, version 9.1.0. 103 lines.

- Page: https://pluginprobe.com/plugins/activitypub/9.1.0/code/includes/handler/class-undo.php
- Raw: https://pluginprobe.com/plugins/activitypub/9.1.0/raw/includes/handler/class-undo.php
- Modified: 2026-06-11T09:37:44+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/activitypub/9.1.0/code/includes/handler/class-undo.php#L10-L20`.

```php
<?php
/**
 * Undo handler file.
 *
 * @package Activitypub
 */

namespace Activitypub\Handler;

use Activitypub\Collection\Inbox as Inbox_Collection;

use function Activitypub\object_to_uri;

/**
 * Handle Undo requests.
 */
class Undo {
	/**
	 * Initialize the class, registering WordPress hooks.
	 */
	public static function init() {
		\add_action( 'activitypub_inbox_undo', array( self::class, 'handle_undo' ), 10, 2 );
		\add_action( 'activitypub_validate_object', array( self::class, 'validate_object' ), 10, 3 );
	}

	/**
	 * Handle "Unfollow" requests.
	 *
	 * @param array          $activity The JSON "Undo" Activity.
	 * @param int|int[]|null $user_ids The user ID(s).
	 */
	public static function handle_undo( $activity, $user_ids ) {
		$success = false;

		/*
		 * Resolve the sender so Inbox::undo() can verify ownership. A genuinely absent actor
		 * maps to null (no ownership check, for programmatic callers), but an actor that is
		 * present yet unparseable must be rejected rather than skipping the check — passing
		 * null there would re-open the undo-by-id attack.
		 */
		$actor = isset( $activity['actor'] ) ? object_to_uri( $activity['actor'] ) : null;

		if ( isset( $activity['actor'] ) && empty( $actor ) ) {
			$result = new \WP_Error(
				'activitypub_undo_invalid_actor',
				\__( 'The Undo activity has an invalid actor.', 'activitypub' ),
				array( 'status' => 400 )
			);
		} else {
			$result = Inbox_Collection::undo( object_to_uri( $activity['object'] ), $actor );
		}

		if ( $result && ! \is_wp_error( $result ) ) {
			$success = true;
		}

		/**
		 * Fires after an ActivityPub Undo activity has been handled.
		 *
		 * @param array              $activity The ActivityPub activity data.
		 * @param int[]              $user_ids The local user IDs.
		 * @param bool               $success  True on success, false on failure.
		 * @param \WP_Comment|string $result   The target, based on the activity that is being undone.
		 */
		\do_action( 'activitypub_handled_undo', $activity, (array) $user_ids, $success, $result );
	}

	/**
	 * Validate the object.
	 *
	 * @param bool             $valid   The validation state.
	 * @param string           $param   The object parameter.
	 * @param \WP_REST_Request $request The request object.
	 *
	 * @return bool The validation state: true if valid, false if not.
	 */
	public static function validate_object( $valid, $param, $request ) {
		$activity = $request->get_json_params();

		if ( empty( $activity['type'] ) ) {
			return false;
		}

		if ( 'Undo' !== $activity['type'] ) {
			return $valid;
		}

		if ( ! isset( $activity['actor'], $activity['object'] ) ) {
			return false;
		}

		if ( ! \is_array( $activity['object'] ) && ! \is_string( $activity['object'] ) ) {
			return false;
		}

		if ( \is_array( $activity['object'] ) && ! isset( $activity['object']['id'] ) ) {
			return false;
		}

		return $valid;
	}
}

```