← All changes | includes/handler/class-reject.php +21 -3 8.2.1 → 9.2.1 View file →

		@@ -55,16 +55,26 @@
55	55	* @param array $reject The activity-object.
56	56	* @param int|int[] $user_ids The user ID(s).
57	57	*/
58	58	private static function reject_follow( $reject, $user_ids ) {
59		- $actor_uri = $reject['object']['actor'] ?? '';
60		- $actor_post = Remote_Actors::get_by_uri( object_to_uri( $actor_uri ) );
	59	+ /*
	60	+ * For a Follow Reject, the sender must be the actor that was followed.
	61	+ * Without this, a signed Reject from one actor could cancel a Follow that
	62	+ * targeted another actor by referencing that pending Follow's outbox GUID.
	63	+ */
	64	+ $reject_actor = object_to_uri( $reject['actor'] ?? '' );
	65	+ $followed_actor = object_to_uri( $reject['object']['object'] ?? '' );
	66	+ if ( ! $reject_actor || ! $followed_actor || $reject_actor !== $followed_actor ) {
	67	+ return;
	68	+ }
61	69
	70	+ $actor_post = Remote_Actors::get_by_uri( $followed_actor );
	71	+
62	72	if ( \is_wp_error( $actor_post ) ) {
63	73	return;
64	74	}
65	75
66		- $user_id = is_array( $user_ids ) ? reset( $user_ids ) : $user_ids;
	76	+ $user_id = \is_array( $user_ids ) ? \reset( $user_ids ) : $user_ids;
67	77	$result = Following::reject( $actor_post, $user_id );
68	78	$success = ! \is_wp_error( $result );
69	79
70	80	/**
		@@ -98,8 +108,16 @@
98	108	return $valid;
99	109	}
100	110
101	111	if ( ! isset( $activity['actor'], $activity['object'] ) ) {
	112	+ return false;
	113	+ }
	114	+
	115	+ if ( ! \is_array( $activity['object'] ) ) {
	116	+ return false;
	117	+ }
	118	+
	119	+ if ( ! isset( $activity['object']['id'], $activity['object']['type'], $activity['object']['actor'], $activity['object']['object'] ) ) {
102	120	return false;
103	121	}
104	122
105	123	return $valid;