Merge branch 'master' into add/query-follower-list

README.md

@@ -3,7 +3,7 @@
 **Tags:** OStatus, fediverse, activitypub, activitystream  
 **Requires at least:** 4.7  
 **Tested up to:** 6.3  
-**Stable tag:** 1.0.5  
+**Stable tag:** 1.0.6  
 **Requires PHP:** 5.6  
 **License:** MIT  
 **License URI:** http://opensource.org/licenses/MIT  
@@ -105,6 +105,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [automattic/wordpress-activitypub](https://github.com/automattic/wordpress-activitypub).
 
+### 1.0.6 ###
+
+* Fixed: more restrictive request verification
+
 ### 1.0.5 ###
 
 * Fixed: compatibility with WebFinger and NodeInfo plugin

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/pfefferle/wordpress-activitypub/
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 1.0.5
+ * Version: 1.0.6
  * Author: Matthias Pfefferle & Automattic
  * Author URI: https://automattic.com/
  * License: MIT
@@ -15,6 +15,7 @@
 
 namespace Activitypub;
 
+use function Activitypub\is_blog_public;
 use function Activitypub\site_supports_blocks;
 
 require_once __DIR__ . '/includes/compat.php';
@@ -52,7 +53,7 @@ function rest_init() {
 	Rest\Collection::init();
 
 	// load NodeInfo endpoints only if blog is public
-	if ( \get_option( 'blog_public', 1 ) ) {
+	if ( is_blog_public() ) {
 		Rest\NodeInfo::init();
 	}
 }

includes/class-mention.php

@@ -2,6 +2,7 @@
 namespace Activitypub;
 
 use WP_Error;
+use Activitypub\Webfinger;
 
 /**
  * ActivityPub Mention Class

includes/functions.php

@@ -472,3 +472,12 @@ function site_supports_blocks() {
 function is_json( $data ) {
 	return \is_array( \json_decode( $data, true ) ) ? true : false;
 }
+
+/**
+ * Check if a blog is public based on the `blog_public` option
+ *
+ * @return bollean True if public, false if not
+ */
+function is_blog_public() {
+	return (bool) apply_filters( 'activitypub_is_blog_public', \get_option( 'blog_public', 1 ) );
+}

includes/rest/class-inbox.php

@@ -38,7 +38,7 @@ class Inbox {
 			'/inbox',
 			array(
 				array(
-					'methods'             => WP_REST_Server::EDITABLE,
+					'methods'             => WP_REST_Server::CREATABLE,
 					'callback'            => array( self::class, 'shared_inbox_post' ),
 					'args'                => self::shared_inbox_post_parameters(),
 					'permission_callback' => '__return_true',
@@ -51,7 +51,7 @@ class Inbox {
 			'/users/(?P<user_id>[\w\-\.]+)/inbox',
 			array(
 				array(
-					'methods'             => WP_REST_Server::EDITABLE,
+					'methods'             => WP_REST_Server::CREATABLE,
 					'callback'            => array( self::class, 'user_inbox_post' ),
 					'args'                => self::user_inbox_post_parameters(),
 					'permission_callback' => '__return_true',

includes/rest/class-server.php

@@ -86,7 +86,7 @@ class Server {
 		}
 
 		// POST-Requets are always signed
-		if ( 'post' === \strtolower( $request->get_method() ) ) {
+		if ( 'get' !== \strtolower( $request->get_method() ) ) {
 			$verified_request = Signature::verify_http_signature( $request );
 			if ( \is_wp_error( $verified_request ) ) {
 				return $verified_request;

integration/class-webfinger.php

@@ -1,6 +1,7 @@
 <?php
 namespace Activitypub\Integration;
 
+use Activitypub\Rest\Webfinger as Webfinger_Rest;
 use Activitypub\Collection\Users as User_Collection;
 
 /**
@@ -52,6 +53,6 @@ class Webfinger {
 			return $array;
 		}
 
-		return self::get_profile( $resource );
+		return Webfinger_Rest::get_profile( $resource );
 	}
 }

readme.txt

@@ -3,7 +3,7 @@ Contributors: automattic, pfefferle, mediaformat, mattwiebe, akirk, jeherve, nur
 Tags: OStatus, fediverse, activitypub, activitystream
 Requires at least: 4.7
 Tested up to: 6.3
-Stable tag: 1.0.5
+Stable tag: 1.0.6
 Requires PHP: 5.6
 License: MIT
 License URI: http://opensource.org/licenses/MIT
@@ -105,6 +105,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [automattic/wordpress-activitypub](https://github.com/automattic/wordpress-activitypub).
 
+= 1.0.6 =
+
+* Fixed: more restrictive request verification
+
 = 1.0.5 =
 
 * Fixed: compatibility with WebFinger and NodeInfo plugin