← All changes | includes/model/class-user.php +78 -22 8.2.1 → 9.2.1 View file →

		@@ -139,11 +139,11 @@
139	139	*
140	140	* @return string The User description.
141	141	*/
142	142	public function get_summary() {
143		- $description = get_user_option( 'activitypub_description', $this->_id );
	143	+ $description = \get_user_option( 'activitypub_description', $this->_id );
144	144	if ( empty( $description ) ) {
145		- $description = get_user_meta( $this->_id, 'description', true );
	145	+ $description = \get_user_meta( $this->_id, 'description', true );
146	146	}
147	147	return \wpautop( \wp_kses( $description, 'default' ) );
148	148	}
149	149
		@@ -152,9 +152,9 @@
152	152	*
153	153	* @return string The User url.
154	154	*/
155	155	public function get_url() {
156		- return \esc_url( \get_author_posts_url( $this->_id ) );
	156	+ return \esc_url_raw( \get_author_posts_url( $this->_id ) );
157	157	}
158	158
159	159	/**
160	160	* Returns the User URL with @-Prefix for the username.
		@@ -161,9 +161,9 @@
161	161	*
162	162	* @return string The User URL with @-Prefix for the username.
163	163	*/
164	164	public function get_alternate_url() {
165		- return \esc_url( \trailingslashit( get_home_url() ) . '@' . $this->get_preferred_username() );
	165	+ return \esc_url_raw( \trailingslashit( \get_home_url() ) . '@' . $this->get_preferred_username() );
166	166	}
167	167
168	168	/**
169	169	* Get the preferred username.
		@@ -187,16 +187,16 @@
187	187	* @return string[] The User icon.
188	188	*/
189	189	public function get_icon() {
190	190	$icon = \get_user_option( 'activitypub_icon', $this->_id );
191		- if ( false !== $icon && wp_attachment_is_image( $icon ) ) {
	191	+ if ( false !== $icon && \wp_attachment_is_image( $icon ) ) {
192	192	return array(
193	193	'type' => 'Image',
194		- 'url' => esc_url( wp_get_attachment_url( $icon ) ),
	194	+ 'url' => \esc_url_raw( \wp_get_attachment_url( $icon ) ),
195	195	);
196	196	}
197	197
198		- $icon = \esc_url(
	198	+ $icon = \esc_url_raw(
199	199	\get_avatar_url(
200	200	$this->_id,
201	201	array( 'size' => 120 )
202	202	)
		@@ -213,9 +213,9 @@
213	213	*
214	214	* @return string[]|null The header image.
215	215	*/
216	216	public function get_image() {
217		- $header_image = get_user_option( 'activitypub_header_image', $this->_id );
	217	+ $header_image = \get_user_option( 'activitypub_header_image', $this->_id );
218	218	$image_url = null;
219	219
220	220	if ( ! $header_image && \has_header_image() ) {
221	221	$image_url = \get_header_image();
		@@ -227,9 +227,9 @@
227	227
228	228	if ( $image_url ) {
229	229	return array(
230	230	'type' => 'Image',
231		- 'url' => esc_url( $image_url ),
	231	+ 'url' => \esc_url_raw( $image_url ),
232	232	);
233	233	}
234	234
235	235	return null;
		@@ -262,9 +262,9 @@
262	262	*
263	263	* @return string The Inbox-Endpoint.
264	264	*/
265	265	public function get_inbox() {
266		- return get_rest_url_by_path( sprintf( 'actors/%d/inbox', $this->get__id() ) );
	266	+ return get_rest_url_by_path( \sprintf( 'actors/%d/inbox', $this->get__id() ) );
267	267	}
268	268
269	269	/**
270	270	* Returns the Outbox-API-Endpoint.
		@@ -271,9 +271,9 @@
271	271	*
272	272	* @return string The Outbox-Endpoint.
273	273	*/
274	274	public function get_outbox() {
275		- return get_rest_url_by_path( sprintf( 'actors/%d/outbox', $this->get__id() ) );
	275	+ return get_rest_url_by_path( \sprintf( 'actors/%d/outbox', $this->get__id() ) );
276	276	}
277	277
278	278	/**
279	279	* Returns the Followers-API-Endpoint.
		@@ -280,9 +280,9 @@
280	280	*
281	281	* @return string The Followers-Endpoint.
282	282	*/
283	283	public function get_followers() {
284		- return get_rest_url_by_path( sprintf( 'actors/%d/followers', $this->get__id() ) );
	284	+ return get_rest_url_by_path( \sprintf( 'actors/%d/followers', $this->get__id() ) );
285	285	}
286	286
287	287	/**
288	288	* Returns the Following-API-Endpoint.
		@@ -289,9 +289,9 @@
289	289	*
290	290	* @return string The Following-Endpoint.
291	291	*/
292	292	public function get_following() {
293		- return get_rest_url_by_path( sprintf( 'actors/%d/following', $this->get__id() ) );
	293	+ return get_rest_url_by_path( \sprintf( 'actors/%d/following', $this->get__id() ) );
294	294	}
295	295
296	296	/**
297	297	* Returns the Liked API endpoint.
		@@ -300,9 +300,9 @@
300	300	*
301	301	* @return string The Liked endpoint.
302	302	*/
303	303	public function get_liked() {
304		- return get_rest_url_by_path( sprintf( 'actors/%d/liked', $this->get__id() ) );
	304	+ return get_rest_url_by_path( \sprintf( 'actors/%d/liked', $this->get__id() ) );
305	305	}
306	306
307	307	/**
308	308	* Returns the Featured-API-Endpoint.
		@@ -309,9 +309,9 @@
309	309	*
310	310	* @return string The Featured-Endpoint.
311	311	*/
312	312	public function get_featured() {
313		- return get_rest_url_by_path( sprintf( 'actors/%d/collections/featured', $this->get__id() ) );
	313	+ return get_rest_url_by_path( \sprintf( 'actors/%d/collections/featured', $this->get__id() ) );
314	314	}
315	315
316	316	/**
317	317	* Returns the Featured-Tags-API-Endpoint.
		@@ -318,9 +318,9 @@
318	318	*
319	319	* @return string The Featured-Tags-Endpoint.
320	320	*/
321	321	public function get_featured_tags() {
322		- return get_rest_url_by_path( sprintf( 'actors/%d/collections/tags', $this->get__id() ) );
	322	+ return get_rest_url_by_path( \sprintf( 'actors/%d/collections/tags', $this->get__id() ) );
323	323	}
324	324
325	325	/**
326	326	* Returns the endpoints.
		@@ -327,9 +327,9 @@
327	327	*
328	328	* @return string[]|null The endpoints.
329	329	*/
330	330	public function get_endpoints() {
331		- return array(
	331	+ $endpoints = array(
332	332	'sharedInbox' => get_rest_url_by_path( 'inbox' ),
333	333	'oauthAuthorizationEndpoint' => get_rest_url_by_path( 'oauth/authorize' ),
334	334	'oauthTokenEndpoint' => get_rest_url_by_path( 'oauth/token' ),
335	335	'oauthRegistrationEndpoint' => get_rest_url_by_path( 'oauth/clients' ),
		@@ -335,8 +335,18 @@
335	335	'oauthRegistrationEndpoint' => get_rest_url_by_path( 'oauth/clients' ),
336	336	'proxyUrl' => get_rest_url_by_path( 'proxy' ),
337	337	'proxyEventStream' => get_rest_url_by_path( 'proxy/stream' ),
338	338	);
	339	+
	340	+ if ( \get_option( 'activitypub_api', false ) ) {
	341	+ /*
	342	+ * RFC 6570 template. add_query_arg() picks the ?/& separator (plain permalinks already
	343	+ * carry a query string) and does not encode values, so the {q} placeholder stays intact.
	344	+ */
	345	+ $endpoints['actorAutocomplete'] = \add_query_arg( 'q', '{q}', get_rest_url_by_path( 'actors/autocomplete' ) );
	346	+ }
	347	+
	348	+ return $endpoints;
339	349	}
340	350
341	351	/**
342	352	* Extend the User-Output with Attachments.
		@@ -427,12 +437,12 @@
427	437	* @param int $value The new value. Should be an attachment ID.
428	438	* @return bool True if the attribute was updated, false otherwise.
429	439	*/
430	440	public function update_icon( $value ) {
431		- if ( ! wp_attachment_is_image( $value ) ) {
	441	+ if ( ! \wp_attachment_is_image( $value ) ) {
432	442	return false;
433	443	}
434		- return update_user_option( $this->_id, 'activitypub_icon', $value );
	444	+ return \update_user_option( $this->_id, 'activitypub_icon', $value );
435	445	}
436	446
437	447	/**
438	448	* Update the User-Header-Image.
		@@ -440,9 +450,9 @@
440	450	* @param int $value The new value. Should be an attachment ID.
441	451	* @return bool True if the attribute was updated, false otherwise.
442	452	*/
443	453	public function update_header( $value ) {
444		- if ( ! wp_attachment_is_image( $value ) ) {
	454	+ if ( ! \wp_attachment_is_image( $value ) ) {
445	455	return false;
446	456	}
447	457	return \update_user_option( $this->_id, 'activitypub_header_image', $value );
448	458	}
		@@ -467,11 +477,11 @@
467	477	$this->get_url(),
468	478	$this->get_alternate_url(),
469	479	);
470	480
471		- $also_known_as = array_merge( $also_known_as, \get_user_option( 'activitypub_also_known_as', $this->_id ) ?: array() );
	481	+ $also_known_as = \array_merge( $also_known_as, \get_user_option( 'activitypub_also_known_as', $this->_id ) ?: array() );
472	482
473		- return array_unique( $also_known_as );
	483	+ return \array_unique( $also_known_as );
474	484	}
475	485
476	486	/**
477	487	* Returns the movedTo.
		@@ -481,6 +491,52 @@
481	491	public function get_moved_to() {
482	492	$moved_to = \get_user_option( 'activitypub_moved_to', $this->_id );
483	493
484	494	return $moved_to && $moved_to !== $this->get_id() ? $moved_to : null;
	495	+ }
	496	+
	497	+ /**
	498	+ * Get the actor-level interaction policy.
	499	+ *
	500	+ * Overrides the magic property accessor on Base_Object so that we always
	501	+ * compute the policy from the current site setting rather than returning a
	502	+ * cached property value. Currently only emits `canFeature` (FEP-7aa9).
	503	+ * Driven by the site option `activitypub_default_feature_policy` and
	504	+ * defaults to denying all featured-collection requests, in line with
	505	+ * FEP-7aa9's "absence of policy = no consent" rule.
	506	+ *
	507	+ * @see https://w3id.org/fep/7aa9
	508	+ *
	509	+ * @since 9.0.0
	510	+ *
	511	+ * @return array
	512	+ */
	513	+ public function get_interaction_policy() {
	514	+ $policy = array( 'canFeature' => $this->build_can_feature_policy() );
	515	+
	516	+ // Merge with an explicitly set interaction policy, if any.
	517	+ if ( $this->interaction_policy ) {
	518	+ $policy = \array_merge( (array) $this->interaction_policy, $policy );
	519	+ }
	520	+
	521	+ return $policy;
	522	+ }
	523	+
	524	+ /**
	525	+ * Build the `canFeature` policy array from the site option.
	526	+ *
	527	+ * @return array
	528	+ */
	529	+ protected function build_can_feature_policy() {
	530	+ $policy = \get_option( 'activitypub_default_feature_policy', ACTIVITYPUB_INTERACTION_POLICY_ME );
	531	+
	532	+ switch ( $policy ) {
	533	+ case ACTIVITYPUB_INTERACTION_POLICY_ANYONE:
	534	+ return array( 'automaticApproval' => array( 'https://www.w3.org/ns/activitystreams#Public' ) );
	535	+ case ACTIVITYPUB_INTERACTION_POLICY_FOLLOWERS:
	536	+ return array( 'automaticApproval' => array( $this->get_followers() ) );
	537	+ case ACTIVITYPUB_INTERACTION_POLICY_ME:
	538	+ default:
	539	+ return array( 'automaticApproval' => array( $this->get_id() ) );
	540	+ }
485	541	}
486	542	}