← All changes | includes/handler/class-accept.php +12 -2 8.2.1 → 9.2.1 View file →

		@@ -10,8 +10,9 @@
10	10	use Activitypub\Collection\Following;
11	11	use Activitypub\Collection\Outbox;
12	12	use Activitypub\Collection\Remote_Actors;
13	13
	14	+use function Activitypub\is_same_actor;
14	15	use function Activitypub\object_to_uri;
15	16
16	17	/**
17	18	* Handle Accept requests.
		@@ -41,15 +42,24 @@
41	42	) {
42	43	return;
43	44	}
44	45
45		- $actor_post = Remote_Actors::get_by_uri( object_to_uri( $accept['object']['object'] ) );
	46	+ /*
	47	+ * For a Follow Accept, the sender must be the actor that was followed.
	48	+ * Without this, a signed Accept from one actor could confirm a Follow that
	49	+ * targeted another actor by referencing that pending Follow's outbox GUID.
	50	+ */
	51	+ if ( ! is_same_actor( $accept['actor'] ?? '', $accept['object']['object'] ?? '' ) ) {
	52	+ return;
	53	+ }
46	54
	55	+ $actor_post = Remote_Actors::get_by_uri( object_to_uri( $accept['object']['object'] ?? '' ) );
	56	+
47	57	if ( \is_wp_error( $actor_post ) ) {
48	58	return;
49	59	}
50	60
51		- $user_id = is_array( $user_ids ) ? reset( $user_ids ) : $user_ids;
	61	+ $user_id = \is_array( $user_ids ) ? \reset( $user_ids ) : $user_ids;
52	62	$result = Following::accept( $actor_post, $user_id );
53	63	$success = ! \is_wp_error( $result );
54	64
55	65	/**