From 5200eb24636238657ce6177ebdd09b637577e849 Mon Sep 17 00:00:00 2001
From: Edward Ficklin <edward.ficklin@gmail.com>
Date: Tue, 14 Mar 2023 13:34:50 -0400
Subject: [PATCH 01/20] define const for fedi bio meta key

---
 activitypub.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/activitypub.php b/activitypub.php
index b72901b..1a23d8d 100644
--- a/activitypub.php
+++ b/activitypub.php
@@ -25,6 +25,7 @@ function init() {
 	\defined( 'ACTIVITYPUB_USERNAME_REGEXP' ) || \define( 'ACTIVITYPUB_USERNAME_REGEXP', '(?:([A-Za-z0-9_-]+)@((?:[A-Za-z0-9_-]+\.)+[A-Za-z]+))' );
 	\defined( 'ACTIVITYPUB_ALLOWED_HTML' ) || \define( 'ACTIVITYPUB_ALLOWED_HTML', '<strong><a><p><ul><ol><li><code><blockquote><pre><img>' );
 	\defined( 'ACTIVITYPUB_CUSTOM_POST_CONTENT' ) || \define( 'ACTIVITYPUB_CUSTOM_POST_CONTENT', "<p><strong>[ap_title]</strong></p>\n\n[ap_content]\n\n<p>[ap_hashtags]</p>\n\n<p>[ap_shortlink]</p>" );
+	\defined( 'ACTIVITYPUB_USER_DESCRIPTION_KEY' ) || \define( 'ACTIVITYPUB_USER_DESCRIPTION_KEY', 'activitypub_user_description' );
 	\define( 'ACTIVITYPUB_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 	\define( 'ACTIVITYPUB_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
 	\define( 'ACTIVITYPUB_PLUGIN_FILE', plugin_dir_path( __FILE__ ) . '/' . basename( __FILE__ ) );

From 3ed96471de419114eb5606cd38d0bca34ddaff6e Mon Sep 17 00:00:00 2001
From: Edward Ficklin <edward.ficklin@gmail.com>
Date: Tue, 14 Mar 2023 13:36:12 -0400
Subject: [PATCH 02/20] add profile field and save handling for fediverse
 specific bio

---
 includes/class-admin.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/includes/class-admin.php b/includes/class-admin.php
index e98d547..4acef35 100644
--- a/includes/class-admin.php
+++ b/includes/class-admin.php
@@ -14,6 +14,7 @@ class Admin {
 		\add_action( 'admin_menu', array( '\Activitypub\Admin', 'admin_menu' ) );
 		\add_action( 'admin_init', array( '\Activitypub\Admin', 'register_settings' ) );
 		\add_action( 'show_user_profile', array( '\Activitypub\Admin', 'add_fediverse_profile' ) );
+		\add_action( 'personal_options_update', array( '\Activitypub\Admin', 'save_user_description' ) );
 		\add_action( 'admin_enqueue_scripts', array( '\Activitypub\Admin', 'enqueue_scripts' ) );
 	}
 
@@ -153,10 +154,27 @@ class Admin {
 	}
 
 	public static function add_fediverse_profile( $user ) {
+		$ap_description = get_user_meta( $user->ID, ACTIVITYPUB_USER_DESCRIPTION_KEY, true );
 		?>
 		<h2 id="activitypub"><?php \esc_html_e( 'ActivityPub', 'activitypub' ); ?></h2>
 		<?php
 		\Activitypub\get_identifier_settings( $user->ID );
+		?>
+		<table class="form-table" role="presentation">
+			<tr class="activitypub-user-description-wrap">
+				<th><label for="activitypub-user-description"><?php _e( 'Fediverse Biography', 'activitypub' ); ?></label></th>
+				<td><textarea name="activitypub-user-description" id="activitypub-user-description" rows="5" cols="30"><?php echo \esc_html( $ap_description ) ?></textarea>
+				<p><?php _e( 'If you wish to use different biographical info for the fediverse, enter your alternate bio here.', 'activitypub' ); ?></p></td>
+			</tr>
+		</table>
+		<?php
+	}
+
+	public static function save_user_description( $user_id ) {
+		if ( ! current_user_can( 'edit_user', $user_id ) ) {
+			return false;
+		}
+		update_user_meta( $user_id, ACTIVITYPUB_USER_DESCRIPTION_KEY, sanitize_text_field( $_POST['activitypub-user-description'] ) );
 	}
 
 	public static function enqueue_scripts( $hook_suffix ) {

From 01532692f16e05168e3226a23a31db57f19182d5 Mon Sep 17 00:00:00 2001
From: Edward Ficklin <edward.ficklin@gmail.com>
Date: Tue, 14 Mar 2023 13:36:47 -0400
Subject: [PATCH 03/20] template helper function for displaying fedi bio, if
 set

---
 includes/functions.php | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/includes/functions.php b/includes/functions.php
index 8f2e5d9..9b00e8f 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -320,3 +320,17 @@ function url_to_authorid( $url ) {
 
 	return 0;
 }
+
+/**
+ * Return the custom Activity Pub description, if set, or default author description.
+ *
+ * @param int $user_id The user ID.
+ * @return string
+ */
+function get_author_description( $user_id ) {
+	$description = get_user_meta( $user_id, ACTIVITYPUB_USER_DESCRIPTION_KEY, true );
+	if ( empty( $description ) ) {
+		$description = get_user_meta( $user_id, 'description', true );
+	}
+	return $description;
+}

From 277c7ba10f4a83610f058b04e29da9f46121b377 Mon Sep 17 00:00:00 2001
From: Edward Ficklin <edward.ficklin@gmail.com>
Date: Tue, 14 Mar 2023 13:37:20 -0400
Subject: [PATCH 04/20] output fedi bio if set, default if not

---
 templates/author-json.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/author-json.php b/templates/author-json.php
index 1003989..3b355b9 100644
--- a/templates/author-json.php
+++ b/templates/author-json.php
@@ -8,7 +8,7 @@ $json->id = \get_author_posts_url( $author_id );
 $json->type = 'Person';
 $json->name = \get_the_author_meta( 'display_name', $author_id );
 $json->summary = \html_entity_decode(
-	\get_the_author_meta( 'description', $author_id ),
+	\Activitypub\get_author_description( $author_id ),
 	\ENT_QUOTES,
 	'UTF-8'
 );

From 8b92e9d47e8485189713ba0338127100fb479205 Mon Sep 17 00:00:00 2001
From: Edward Ficklin <edward.ficklin@gmail.com>
Date: Tue, 14 Mar 2023 20:35:14 -0400
Subject: [PATCH 05/20] escape output

---
 includes/class-admin.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/class-admin.php b/includes/class-admin.php
index 4acef35..c677246 100644
--- a/includes/class-admin.php
+++ b/includes/class-admin.php
@@ -162,9 +162,9 @@ class Admin {
 		?>
 		<table class="form-table" role="presentation">
 			<tr class="activitypub-user-description-wrap">
-				<th><label for="activitypub-user-description"><?php _e( 'Fediverse Biography', 'activitypub' ); ?></label></th>
-				<td><textarea name="activitypub-user-description" id="activitypub-user-description" rows="5" cols="30"><?php echo \esc_html( $ap_description ) ?></textarea>
-				<p><?php _e( 'If you wish to use different biographical info for the fediverse, enter your alternate bio here.', 'activitypub' ); ?></p></td>
+				<th><label for="activitypub-user-description"><?php \esc_html_e( 'Fediverse Biography', 'activitypub' ); ?></label></th>
+				<td><textarea name="activitypub-user-description" id="activitypub-user-description" rows="5" cols="30"><?php echo \esc_html( $ap_description ); ?></textarea>
+				<p><?php \esc_html_e( 'If you wish to use different biographical info for the fediverse, enter your alternate bio here.', 'activitypub' ); ?></p></td>
 			</tr>
 		</table>
 		<?php

From aed033c03e26bb5d2450f8e1de5fe5bfeb553e7c Mon Sep 17 00:00:00 2001
From: Edward Ficklin <edward.ficklin@gmail.com>
Date: Tue, 14 Mar 2023 20:47:30 -0400
Subject: [PATCH 06/20] nonce verification

---
 includes/class-admin.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/includes/class-admin.php b/includes/class-admin.php
index c677246..8287259 100644
--- a/includes/class-admin.php
+++ b/includes/class-admin.php
@@ -165,12 +165,16 @@ class Admin {
 				<th><label for="activitypub-user-description"><?php \esc_html_e( 'Fediverse Biography', 'activitypub' ); ?></label></th>
 				<td><textarea name="activitypub-user-description" id="activitypub-user-description" rows="5" cols="30"><?php echo \esc_html( $ap_description ); ?></textarea>
 				<p><?php \esc_html_e( 'If you wish to use different biographical info for the fediverse, enter your alternate bio here.', 'activitypub' ); ?></p></td>
+				<?php wp_nonce_field( 'activitypub-user-description', '_apnonce' ); ?>
 			</tr>
 		</table>
 		<?php
 	}
 
 	public static function save_user_description( $user_id ) {
+		if ( ! wp_verify_nonce( $_REQUEST['_apnonce'], 'activitypub-user-description' ) ) {
+			return false;
+		}
 		if ( ! current_user_can( 'edit_user', $user_id ) ) {
 			return false;
 		}

From 804ef2582221dc048c8e17a601691dad991e7344 Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Fri, 21 Apr 2023 08:42:51 +0200
Subject: [PATCH 07/20] count only users that can `publish_posts`

---
 includes/rest/class-nodeinfo.php | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/includes/rest/class-nodeinfo.php b/includes/rest/class-nodeinfo.php
index 100fdd3..980c24b 100644
--- a/includes/rest/class-nodeinfo.php
+++ b/includes/rest/class-nodeinfo.php
@@ -75,13 +75,24 @@ class Nodeinfo {
 			'version' => \get_bloginfo( 'version' ),
 		);
 
-		$users = \count_users();
+		$users = \get_users(
+			array(
+				'capability__in' => array( 'publish_posts' ),
+			)
+		);
+
+		if ( is_array( $users ) ) {
+			$users = count( $users );
+		} else {
+			$users = 1;
+		}
+
 		$posts = \wp_count_posts();
 		$comments = \wp_count_comments();
 
 		$nodeinfo['usage'] = array(
 			'users' => array(
-				'total' => (int) $users['total_users'],
+				'total' => $users,
 			),
 			'localPosts' => (int) $posts->publish,
 			'localComments' => (int) $comments->approved,

From 45ae73bb0660ed6062751ff1ca452e10e7a868eb Mon Sep 17 00:00:00 2001
From: Alex Kirk <akirk@users.noreply.github.com>
Date: Fri, 21 Apr 2023 17:20:48 +0200
Subject: [PATCH 08/20] Add Vary header

---
 includes/class-activitypub.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/includes/class-activitypub.php b/includes/class-activitypub.php
index 4730515..b20eb71 100644
--- a/includes/class-activitypub.php
+++ b/includes/class-activitypub.php
@@ -39,6 +39,8 @@ class Activitypub {
 			return $template;
 		}
 
+		header( 'Vary: Accept' );
+
 		// check if user can publish posts
 		if ( \is_author() && ! user_can( \get_the_author_meta( 'ID' ), 'publish_posts' ) ) {
 			return $template;

From 4ed4d06fd5f651377551fa6860d2b5028cec00ca Mon Sep 17 00:00:00 2001
From: Alex Kirk <akirk@users.noreply.github.com>
Date: Fri, 21 Apr 2023 17:41:04 +0200
Subject: [PATCH 09/20] Add comment

---
 includes/class-activitypub.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/includes/class-activitypub.php b/includes/class-activitypub.php
index b20eb71..16a1f22 100644
--- a/includes/class-activitypub.php
+++ b/includes/class-activitypub.php
@@ -39,6 +39,7 @@ class Activitypub {
 			return $template;
 		}
 
+		// Ensure that edge caches know that this page can deliver both HTML and JSON.
 		header( 'Vary: Accept' );
 
 		// check if user can publish posts

From 28c077e422645d84ea4fc8ff41157e5555fe59a2 Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Sun, 23 Apr 2023 22:56:45 +0200
Subject: [PATCH 10/20] Add URL

---
 includes/model/class-post.php | 43 +++++++++++++++++++++++++++--------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/includes/model/class-post.php b/includes/model/class-post.php
index cfe49b6..76d4d03 100644
--- a/includes/model/class-post.php
+++ b/includes/model/class-post.php
@@ -28,6 +28,13 @@ class Post {
 	 */
 	private $id;
 
+	/**
+	 * The Object URL.
+	 *
+	 * @var string
+	 */
+	private $url;
+
 	/**
 	 * The Object Summary.
 	 *
@@ -179,6 +186,7 @@ class Post {
 
 		$array = array(
 			'id' => $this->get_id(),
+			'url' => $this->get_url(),
 			'type' => $this->get_object_type(),
 			'published' => \gmdate( 'Y-m-d\TH:i:s\Z', \strtotime( $post->post_date_gmt ) ),
 			'attributedTo' => \get_author_posts_url( $post->post_author ),
@@ -206,6 +214,29 @@ class Post {
 		return \wp_json_encode( $this->to_array(), \JSON_HEX_TAG | \JSON_HEX_AMP | \JSON_HEX_QUOT );
 	}
 
+	/**
+	 * Returns the URL of an Activity Object
+	 *
+	 * @return string
+	 */
+	public function get_url() {
+		if ( $this->url ) {
+			return $this->url;
+		}
+
+		$post = $this->post;
+
+		if ( 'trash' === get_post_status( $post ) ) {
+			$permalink = \get_post_meta( $post->url, 'activitypub_canonical_url', true );
+		} else {
+			$permalink = \get_permalink( $post );
+		}
+
+		$this->url = $permalink;
+
+		return $permalink;
+	}
+
 	/**
 	 * Returns the ID of an Activity Object
 	 *
@@ -216,17 +247,9 @@ class Post {
 			return $this->id;
 		}
 
-		$post = $this->post;
+		$this->id = $this->get_url();
 
-		if ( 'trash' === get_post_status( $post ) ) {
-			$permalink = \get_post_meta( $post->ID, 'activitypub_canonical_url', true );
-		} else {
-			$permalink = \get_permalink( $post );
-		}
-
-		$this->id = $permalink;
-
-		return $permalink;
+		return $this->id;
 	}
 
 	/**

From 77415ef510a1ebea33d567c354e87e02cf0df824 Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Sun, 23 Apr 2023 22:57:03 +0200
Subject: [PATCH 11/20] Remove "(Fediverse)"

---
 includes/class-admin.php     | 2 +-
 templates/followers-list.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/class-admin.php b/includes/class-admin.php
index 220ed9b..fbb953a 100644
--- a/includes/class-admin.php
+++ b/includes/class-admin.php
@@ -31,7 +31,7 @@ class Admin {
 
 		\add_action( 'load-' . $settings_page, array( self::class, 'add_settings_help_tab' ) );
 
-		$followers_list_page = \add_users_page( \__( 'Followers', 'activitypub' ), \__( 'Followers (Fediverse)', 'activitypub' ), 'read', 'activitypub-followers-list', array( self::class, 'followers_list_page' ) );
+		$followers_list_page = \add_users_page( \__( 'Followers', 'activitypub' ), \__( 'Followers', 'activitypub' ), 'read', 'activitypub-followers-list', array( self::class, 'followers_list_page' ) );
 
 		\add_action( 'load-' . $followers_list_page, array( self::class, 'add_followers_list_help_tab' ) );
 	}
diff --git a/templates/followers-list.php b/templates/followers-list.php
index 057f498..a7136ce 100644
--- a/templates/followers-list.php
+++ b/templates/followers-list.php
@@ -1,5 +1,5 @@
 <div class="wrap">
-	<h1><?php \esc_html_e( 'Followers (Fediverse)', 'activitypub' ); ?></h1>
+	<h1><?php \esc_html_e( 'Followers', 'activitypub' ); ?></h1>
 
 	<?php // translators: ?>
 	<p><?php \printf( \esc_html__( 'You currently have %s followers.', 'activitypub' ), \esc_attr( \Activitypub\Peer\Followers::count_followers( \get_current_user_id() ) ) ); ?></p>

From 47dc2f72d1095eb02fe0975c95936c82a139ddc5 Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Mon, 24 Apr 2023 09:49:06 +0200
Subject: [PATCH 12/20] fix "bulk replace" issue

---
 includes/model/class-post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/model/class-post.php b/includes/model/class-post.php
index 76d4d03..470ad70 100644
--- a/includes/model/class-post.php
+++ b/includes/model/class-post.php
@@ -227,7 +227,7 @@ class Post {
 		$post = $this->post;
 
 		if ( 'trash' === get_post_status( $post ) ) {
-			$permalink = \get_post_meta( $post->url, 'activitypub_canonical_url', true );
+			$permalink = \get_post_meta( $post->ID, 'activitypub_canonical_url', true );
 		} else {
 			$permalink = \get_permalink( $post );
 		}

From 3f4c44db05e7a6b8df24f7891a177b865972e4d8 Mon Sep 17 00:00:00 2001
From: Jeremy Herve <jeremy@jeremy.hu>
Date: Mon, 24 Apr 2023 09:15:48 +0200
Subject: [PATCH 13/20] Compatibility: do not serve images with Jetpack CDN
 when active

When Jetpack's image CDN is active, core calls to retrieve images return an image served by the CDN.

Since Fediverse instances usually fetch and cache the data themselves, we do not need to use the CDN for those images when returned by the ActivityPub plugin. In fact, we really do not want that to happen, as Fediverse instances may get errors when trying to fetch images from the CDN (they may get blocked / rate-limited / ...).

Let's hook into Jetpack's CDN to avoid that.
---
 includes/model/class-post.php | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/includes/model/class-post.php b/includes/model/class-post.php
index 470ad70..6f33cc3 100644
--- a/includes/model/class-post.php
+++ b/includes/model/class-post.php
@@ -306,7 +306,24 @@ class Post {
 		// get URLs for each image
 		foreach ( $image_ids as $id ) {
 			$alt = \get_post_meta( $id, '_wp_attachment_image_alt', true );
+
+			/**
+			 * If you use the Jetpack plugin and its Image CDN, aka Photon,
+			 * the image strings returned will use the Photon URL.
+			 * We don't want that since Fediverse instances already do caching on their end.
+			 * Let the CDN only be used for visitors of the site.
+			 */
+			if ( class_exists( 'Jetpack_Photon' ) ) {
+				\remove_filter( 'image_downsize', array( \Jetpack_Photon::instance(), 'filter_image_downsize' ) );
+			}
+
 			$thumbnail = \wp_get_attachment_image_src( $id, 'full' );
+
+			// Re-enable Photon now that the image URL has been built.
+			if ( class_exists( 'Jetpack_Photon' ) ) {
+				\add_filter( 'image_downsize', array( \Jetpack_Photon::instance(), 'filter_image_downsize' ), 10, 3 );
+			}
+
 			$mimetype = \get_post_mime_type( $id );
 
 			if ( $thumbnail ) {

From 56d2b7e8be6b6765138dbd6a4170a056c7e95794 Mon Sep 17 00:00:00 2001
From: Jeremy Herve <jeremy@jeremy.hu>
Date: Mon, 24 Apr 2023 09:49:05 +0200
Subject: [PATCH 14/20] Update to handle both old and new versions of Jetpack

See https://github.com/Automattic/jetpack/pull/30050/
---
 includes/model/class-post.php | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/includes/model/class-post.php b/includes/model/class-post.php
index 6f33cc3..a69e139 100644
--- a/includes/model/class-post.php
+++ b/includes/model/class-post.php
@@ -312,15 +312,23 @@ class Post {
 			 * the image strings returned will use the Photon URL.
 			 * We don't want that since Fediverse instances already do caching on their end.
 			 * Let the CDN only be used for visitors of the site.
+			 *
+			 * Old versions of Jetpack used the Jetpack_Photon class to do this.
+			 * New versions use the Image_CDN class.
+			 * Let's handle both.
 			 */
-			if ( class_exists( 'Jetpack_Photon' ) ) {
+			if ( \class_exists( '\Automattic\Jetpack\Image_CDN\Image_CDN' ) ) {
+				\remove_filter( 'image_downsize', array( \Automattic\Jetpack\Image_CDN\Image_CDN::instance(), 'filter_image_downsize' ) );
+			} elseif ( \class_exists( 'Jetpack_Photon' ) ) {
 				\remove_filter( 'image_downsize', array( \Jetpack_Photon::instance(), 'filter_image_downsize' ) );
 			}
 
 			$thumbnail = \wp_get_attachment_image_src( $id, 'full' );
 
 			// Re-enable Photon now that the image URL has been built.
-			if ( class_exists( 'Jetpack_Photon' ) ) {
+			if ( \class_exists( '\Automattic\Jetpack\Image_CDN\Image_CDN' ) ) {
+				\add_filter( 'image_downsize', array( \Automattic\Jetpack\Image_CDN\Image_CDN::instance(), 'filter_image_downsize' ), 10, 3 );
+			} elseif ( \class_exists( 'Jetpack_Photon' ) ) {
 				\add_filter( 'image_downsize', array( \Jetpack_Photon::instance(), 'filter_image_downsize' ), 10, 3 );
 			}
 

From 2afe74b29bf49e5d3745a5f21f10db09892c3001 Mon Sep 17 00:00:00 2001
From: Jeremy Herve <jeremy@jeremy.hu>
Date: Tue, 25 Apr 2023 11:03:33 +0200
Subject: [PATCH 15/20] Compatibility: the plugin is compatible with WP 6.2.

---
 readme.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/readme.txt b/readme.txt
index 9c7661d..6fe6189 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,7 +2,7 @@
 Contributors: pfefferle, mediaformat, akirk, automattic
 Tags: OStatus, fediverse, activitypub, activitystream
 Requires at least: 4.7
-Tested up to: 6.1
+Tested up to: 6.2
 Stable tag: 0.17.0
 Requires PHP: 5.6
 License: MIT

From 6ee59d2a10e5e1d53b3cc93b30850d98a1403145 Mon Sep 17 00:00:00 2001
From: Jeremy Herve <jeremy@jeremy.hu>
Date: Tue, 25 Apr 2023 11:04:32 +0200
Subject: [PATCH 16/20] Add changelog

---
 readme.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/readme.txt b/readme.txt
index 6fe6189..e89c768 100644
--- a/readme.txt
+++ b/readme.txt
@@ -113,6 +113,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [pfefferle/wordpress-activitypub](https://github.com/pfefferle/wordpress-activitypub).
 
+= Next =
+
+* Compatibility: indicate that the plugin is compatible and has been tested with the latest version of WordPress, 6.2.
+
 = 0.17.0 =
 
 * Fix type-selector

From ca646588d2b64af1621221b4a862b9275b02f4c6 Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Tue, 25 Apr 2023 20:44:54 +0200
Subject: [PATCH 17/20] ignore `www` subdomain when comparing hosts

fix #290
---
 includes/rest/class-webfinger.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/includes/rest/class-webfinger.php b/includes/rest/class-webfinger.php
index d41cf25..10dcfa4 100644
--- a/includes/rest/class-webfinger.php
+++ b/includes/rest/class-webfinger.php
@@ -54,15 +54,16 @@ class Webfinger {
 		$resource = \str_replace( 'acct:', '', $resource );
 
 		$resource_identifier = \substr( $resource, 0, \strrpos( $resource, '@' ) );
-		$resource_host = \substr( \strrchr( $resource, '@' ), 1 );
+		$resource_host = \str_replace( 'www.', '', \substr( \strrchr( $resource, '@' ), 1 ) );
+		$blog_host = \str_replace( 'www.', '', \wp_parse_url( \home_url( '/' ), \PHP_URL_HOST ) );
 
-		if ( \wp_parse_url( \home_url( '/' ), \PHP_URL_HOST ) !== $resource_host ) {
+		if ( $blog_host !== $resource_host ) {
 			return new WP_Error( 'activitypub_wrong_host', \__( 'Resource host does not match blog host', 'activitypub' ), array( 'status' => 404 ) );
 		}
 
 		$user = \get_user_by( 'login', \esc_sql( $resource_identifier ) );
 
-		if ( ! $user || ! user_can( $user, 'publish_posts' ) ) {
+		if ( ! $user || ! \user_can( $user, 'publish_posts' ) ) {
 			return new WP_Error( 'activitypub_user_not_found', \__( 'User not found', 'activitypub' ), array( 'status' => 404 ) );
 		}
 

From 98619dc3198181ad44736afdb82cf74ae31a296d Mon Sep 17 00:00:00 2001
From: Alex Kirk <akirk@users.noreply.github.com>
Date: Wed, 26 Apr 2023 10:08:22 +0200
Subject: [PATCH 18/20] Protect img tags from replacing mentions

---
 includes/class-mention.php               | 6 ++++++
 tests/test-class-activitypub-mention.php | 1 +
 2 files changed, 7 insertions(+)

diff --git a/includes/class-mention.php b/includes/class-mention.php
index e0930cc..9c93d80 100644
--- a/includes/class-mention.php
+++ b/includes/class-mention.php
@@ -46,6 +46,12 @@ class Mention {
 			$the_content
 		);
 
+		$the_content = preg_replace_callback(
+			'#<img.*?[^>]+>#i',
+			$protect,
+			$the_content
+		);
+
 		$the_content = \preg_replace_callback( '/@' . ACTIVITYPUB_USERNAME_REGEXP . '/', array( self::class, 'replace_with_links' ), $the_content );
 
 		$the_content = str_replace( array_reverse( array_keys( $protected_tags ) ), array_reverse( array_values( $protected_tags ) ), $the_content );
diff --git a/tests/test-class-activitypub-mention.php b/tests/test-class-activitypub-mention.php
index 6f6b9ff..ca7395f 100644
--- a/tests/test-class-activitypub-mention.php
+++ b/tests/test-class-activitypub-mention.php
@@ -31,6 +31,7 @@ ENDPRE;
 			array( 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@<span>pfefferle</span>@notiz.blog</a> test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@<span>pfefferle</span>@notiz.blog</a> test' ),
 			array( 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@pfefferle@notiz.blog</a> test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@pfefferle@notiz.blog</a> test' ),
 			array( 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/@pfefferle/">@pfefferle@notiz.blog</a> test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/@pfefferle/">@pfefferle@notiz.blog</a> test' ),
+			array( 'hallo <img src="abc" alt="https://notiz.blog/@pfefferle/" title="@pfefferle@notiz.blog"/> test', 'hallo <img src="abc" alt="https://notiz.blog/@pfefferle/" title="@pfefferle@notiz.blog"/> test' ),
 			array( $code, $code ),
 			array( $pre, $pre ),
 		);

From 02e0acdf6917d05864b63748aac16dca37ce0aed Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Fri, 28 Apr 2023 14:39:33 +0200
Subject: [PATCH 19/20] fix indents

---
 includes/class-admin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/class-admin.php b/includes/class-admin.php
index f1f7df8..2b7ee2a 100644
--- a/includes/class-admin.php
+++ b/includes/class-admin.php
@@ -14,7 +14,7 @@ class Admin {
 		\add_action( 'admin_menu', array( self::class, 'admin_menu' ) );
 		\add_action( 'admin_init', array( self::class, 'register_settings' ) );
 		\add_action( 'show_user_profile', array( self::class, 'add_fediverse_profile' ) );
-    \add_action( 'personal_options_update', array( self::class, 'save_user_description' ) );
+		\add_action( 'personal_options_update', array( self::class, 'save_user_description' ) );
 		\add_action( 'admin_enqueue_scripts', array( self::class, 'enqueue_scripts' ) );
 	}
 

From 7c47f9a07c3640d06af0559a0a07ed159e88ab9c Mon Sep 17 00:00:00 2001
From: Matthias Pfefferle <pfefferle@users.noreply.github.com>
Date: Fri, 28 Apr 2023 15:12:30 +0200
Subject: [PATCH 20/20] clean up admin settings

---
 includes/class-admin.php    | 38 +++++++++++++++++--------------------
 includes/functions.php      | 19 -------------------
 templates/user-settings.php | 29 ++++++++++++++++++++++++++++
 3 files changed, 46 insertions(+), 40 deletions(-)
 create mode 100644 templates/user-settings.php

diff --git a/includes/class-admin.php b/includes/class-admin.php
index 2b7ee2a..66966f9 100644
--- a/includes/class-admin.php
+++ b/includes/class-admin.php
@@ -1,6 +1,8 @@
 <?php
 namespace Activitypub;
 
+use Activitypub\Model\Post;
+
 /**
  * ActivityPub Admin Class
  *
@@ -51,9 +53,9 @@ class Admin {
 
 		switch ( $tab ) {
 			case 'settings':
-				\Activitypub\Model\Post::upgrade_post_content_template();
+				Post::upgrade_post_content_template();
 
-				\load_template( \dirname( __FILE__ ) . '/../templates/settings.php' );
+				\load_template( ACTIVITYPUB_PLUGIN_DIR . 'templates/settings.php' );
 				break;
 			case 'welcome':
 			default:
@@ -61,7 +63,7 @@ class Admin {
 				add_thickbox();
 				wp_enqueue_script( 'updates' );
 
-				\load_template( \dirname( __FILE__ ) . '/../templates/welcome.php' );
+				\load_template( ACTIVITYPUB_PLUGIN_DIR . 'templates/welcome.php' );
 				break;
 		}
 	}
@@ -70,7 +72,7 @@ class Admin {
 	 * Load user settings page
 	 */
 	public static function followers_list_page() {
-		\load_template( \dirname( __FILE__ ) . '/../templates/followers-list.php' );
+		\load_template( ACTIVITYPUB_PLUGIN_DIR . 'templates/followers-list.php' );
 	}
 
 	/**
@@ -146,7 +148,7 @@ class Admin {
 	}
 
 	public static function add_settings_help_tab() {
-		require_once \dirname( __FILE__ ) . '/help.php';
+		require_once ACTIVITYPUB_PLUGIN_DIR . 'includes/help.php';
 	}
 
 	public static function add_followers_list_help_tab() {
@@ -154,25 +156,19 @@ class Admin {
 	}
 
 	public static function add_fediverse_profile( $user ) {
-		$ap_description = get_user_meta( $user->ID, ACTIVITYPUB_USER_DESCRIPTION_KEY, true );
-		?>
-		<h2 id="activitypub"><?php \esc_html_e( 'ActivityPub', 'activitypub' ); ?></h2>
-		<?php
-		\Activitypub\get_identifier_settings( $user->ID );
-		?>
-		<table class="form-table" role="presentation">
-			<tr class="activitypub-user-description-wrap">
-				<th><label for="activitypub-user-description"><?php \esc_html_e( 'Fediverse Biography', 'activitypub' ); ?></label></th>
-				<td><textarea name="activitypub-user-description" id="activitypub-user-description" rows="5" cols="30"><?php echo \esc_html( $ap_description ); ?></textarea>
-				<p><?php \esc_html_e( 'If you wish to use different biographical info for the fediverse, enter your alternate bio here.', 'activitypub' ); ?></p></td>
-				<?php wp_nonce_field( 'activitypub-user-description', '_apnonce' ); ?>
-			</tr>
-		</table>
-		<?php
+		$description = get_user_meta( $user->ID, ACTIVITYPUB_USER_DESCRIPTION_KEY, true );
+
+		\load_template(
+			ACTIVITYPUB_PLUGIN_DIR . 'templates/user-settings.php',
+			true,
+			array(
+				'description' => $description,
+			)
+		);
 	}
 
 	public static function save_user_description( $user_id ) {
-		if ( ! wp_verify_nonce( $_REQUEST['_apnonce'], 'activitypub-user-description' ) ) {
+		if ( isset( $_REQUEST['_apnonce'] ) && ! wp_verify_nonce( $_REQUEST['_apnonce'], 'activitypub-user-description' ) ) {
 			return false;
 		}
 		if ( ! current_user_can( 'edit_user', $user_id ) ) {
diff --git a/includes/functions.php b/includes/functions.php
index a436496..4d44853 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -241,25 +241,6 @@ function get_follower_inboxes( $user_id, $cc = array() ) {
 	return $inboxes;
 }
 
-function get_identifier_settings( $user_id ) {
-	?>
-<table class="form-table">
-	<tbody>
-		<tr>
-			<th scope="row">
-				<label><?php \esc_html_e( 'Profile identifier', 'activitypub' ); ?></label>
-			</th>
-			<td>
-				<p><code><?php echo \esc_html( \Activitypub\get_webfinger_resource( $user_id ) ); ?></code> or <code><?php echo \esc_url( \get_author_posts_url( $user_id ) ); ?></code></p>
-				<?php // translators: the webfinger resource ?>
-				<p class="description"><?php \printf( \esc_html__( 'Try to follow "@%s" by searching for it on Mastodon,Friendica & Co.', 'activitypub' ), \esc_html( \Activitypub\get_webfinger_resource( $user_id ) ) ); ?></p>
-			</td>
-		</tr>
-	</tbody>
-</table>
-	<?php
-}
-
 function get_followers( $user_id ) {
 	$followers = \Activitypub\Peer\Followers::get_followers( $user_id );
 
diff --git a/templates/user-settings.php b/templates/user-settings.php
new file mode 100644
index 0000000..24a6484
--- /dev/null
+++ b/templates/user-settings.php
@@ -0,0 +1,29 @@
+<h2 id="activitypub"><?php \esc_html_e( 'ActivityPub', 'activitypub' ); ?></h2>
+
+<table class="form-table">
+	<tbody>
+		<tr>
+			<th scope="row">
+				<label><?php \esc_html_e( 'Profile identifier', 'activitypub' ); ?></label>
+			</th>
+			<td>
+				<p>
+					<code><?php echo \esc_html( \Activitypub\get_webfinger_resource( \get_current_user_id() ) ); ?></code> or
+					<code><?php echo \esc_url( \get_author_posts_url( \get_current_user_id() ) ); ?></code>
+				</p>
+				<?php // translators: the webfinger resource ?>
+				<p class="description"><?php \printf( \esc_html__( 'Try to follow "@%s" by searching for it on Mastodon,Friendica & Co.', 'activitypub' ), \esc_html( \Activitypub\get_webfinger_resource( \get_current_user_id() ) ) ); ?></p>
+			</td>
+		</tr>
+		<tr class="activitypub-user-description-wrap">
+			<th>
+				<label for="activitypub-user-description"><?php \esc_html_e( 'Biography', 'activitypub' ); ?></label>
+			</th>
+			<td>
+				<textarea name="activitypub-user-description" id="activitypub-user-description" rows="5" cols="30" placeholder="<?php echo \esc_html( get_user_meta( \get_current_user_id(), 'description', true ) ); ?>"><?php echo \esc_html( $args['description'] ); ?></textarea>
+				<p class="description"><?php \esc_html_e( 'If you wish to use different biographical info for the fediverse, enter your alternate bio here.', 'activitypub' ); ?></p>
+			</td>
+			<?php wp_nonce_field( 'activitypub-user-description', '_apnonce' ); ?>
+		</tr>
+	</tbody>
+</table>