Merge branch 'master' into signature_verification

.distignore

@@ -22,6 +22,8 @@ bin
 composer.json
 composer.lock
 docker-compose.yml
+docker-compose-test.yml
+Dockerfile
 gulpfile.js
 package.json
 node_modules

.github/stale.yml

@@ -0,0 +1,17 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 120
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - pinned
+  - security
+# Label to use when marking an issue as stale
+staleLabel: wontfix
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false

.github/workflows/deploy.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
     - uses: actions/checkout@master
     - name: WordPress Plugin Deploy
-      uses: 10up/action-wordpress-plugin-deploy@master
+      uses: 10up/action-wordpress-plugin-deploy@stable
       env:
         SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
         SVN_USERNAME: ${{ secrets.SVN_USERNAME }}

.github/workflows/phpcs.yml

@@ -1,5 +1,7 @@
 name: PHP_CodeSniffer
-on: push
+on:
+  push:
+  pull_request:
 jobs:
   phpcs:
     runs-on: ubuntu-latest

.github/workflows/phpunit.yml

@@ -1,9 +1,9 @@
 name: Unit Testing
 on:
-    push:
+  push:
-    pull_request:
+  pull_request:
 jobs:
-  phpcs:
+  phpunit:
     runs-on: ubuntu-latest
     services:
      mysql:
@@ -15,7 +15,7 @@ jobs:
        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=10s --health-retries=10
     strategy:
       matrix:
-        php-versions: ['5.6', '7.2', '7.3', '7.4', '8.0', '8.1']
+        php-versions: ['5.6', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2']
     steps:
       - name: Checkout
         uses: actions/checkout@v2

.github/workflows/update-assets.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
     - uses: actions/checkout@master
     - name: WordPress.org plugin asset/readme update
-      uses: 10up/action-wordpress-plugin-asset-update@master
+      uses: 10up/action-wordpress-plugin-asset-update@stable
       env:
         SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
         SVN_USERNAME: ${{ secrets.SVN_USERNAME }}

.gitignore

@@ -5,3 +5,5 @@ composer.lock
 .DS_Store
 .idea/
 .php_cs.cache
+.vscode/settings.json
+.phpunit.result.cache

Dockerfile

@@ -0,0 +1,27 @@
+FROM php:7.4-alpine3.13
+
+RUN mkdir /app
+
+WORKDIR /app
+
+# Install Git, NPM & needed libraries
+RUN apk update \
+    && apk add bash git nodejs npm gettext subversion mysql mysql-client zip \
+    && rm -f /var/cache/apk/*
+
+RUN docker-php-ext-install mysqli
+
+#  Install Composer
+RUN EXPECTED_CHECKSUM=$(curl -s https://composer.github.io/installer.sig) \
+    && curl https://getcomposer.org/installer -o composer-setup.php \
+    && ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" \
+    && if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then >&2 echo 'ERROR: Invalid installer checksum'; rm composer-setup.php; exit 1; fi \
+    && php composer-setup.php --quiet \
+    && php -r "unlink('composer-setup.php');" \
+    && mv composer.phar /usr/local/bin/composer
+
+RUN curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && \
+    chmod +x wp-cli.phar && \
+    mv wp-cli.phar /usr/local/bin/wp
+
+RUN chmod +x -R ./

README.md

@@ -1,10 +1,10 @@
 # ActivityPub #
-**Contributors:** [pfefferle](https://profiles.wordpress.org/pfefferle), [mediaformat](https://profiles.wordpress.org/mediaformat)  
+**Contributors:** [pfefferle](https://profiles.wordpress.org/pfefferle/), [mediaformat](https://profiles.wordpress.org/mediaformat/), [akirk](https://profiles.wordpress.org/akirk/)  
 **Donate link:** https://notiz.blog/donate/  
 **Tags:** OStatus, fediverse, activitypub, activitystream  
 **Requires at least:** 4.7  
-**Tested up to:** 5.9  
+**Tested up to:** 6.1  
-**Stable tag:** 0.13.3  
+**Stable tag:** 0.16.2  
 **Requires PHP:** 5.6  
 **License:** MIT  
 **License URI:** http://opensource.org/licenses/MIT  
@@ -88,6 +88,53 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [pfefferle/wordpress-activitypub](https://github.com/pfefferle/wordpress-activitypub).
 
+### 0.16.2 ###
+
+* Fix fatal error in outbox
+
+### 0.16.1 ###
+
+* Fix "update and create, posts appear blank on Mastodon" issue
+
+### 0.16.0 ###
+
+* Add "Outgoing Mentions" ([#213](https://github.com/pfefferle/wordpress-activitypub/pull/213)) props [@akirk](https://github.com/akirk)
+* Add configuration item for number of images to attach ([#248](https://github.com/pfefferle/wordpress-activitypub/pull/248)) props [@mexon](https://github.com/mexon)
+* Use shortcodes instead of custom templates, to setup the Activity Post-Content ([#250](https://github.com/pfefferle/wordpress-activitypub/pull/250)) props [@toolstack](https://github.com/toolstack)
+* Remove custom REST Server, because the needed changes are now merged into Core.
+* Fix hashtags ([#261](https://github.com/pfefferle/wordpress-activitypub/pull/261)) props [@akirk](https://github.com/akirk)
+* Change priorites, to maybe fix the hashtag issue
+
+### 0.15.0 ###
+
+* Enable ActivityPub only for users that can `publish_posts`
+* Persist only public Activities
+* Fix remote-delete
+
+### 0.14.3 ###
+
+* Better error handling. props [@akirk](https://github.com/akirk)
+
+### 0.14.2 ###
+
+* Fix Critical error when using Friends Plugin and adding new URL to follow. props [@akirk](https://github.com/akirk)
+
+### 0.14.1 ###
+
+* Fix "WebFinger not compatible with PHP < 8.0". props [@mexon](https://github.com/mexon)
+
+### 0.14.0 ###
+
+* Friends support: https://wordpress.org/plugins/friends/ props [@akirk](https://github.com/akirk)
+* Massive guidance improvements. props [mediaformat](https://github.com/mediaformat) & [@akirk](https://github.com/akirk)
+* Add Custom Post Type support to outbox API. props [blueset](https://github.com/blueset)
+* Better hash-tag support. props [bocops](https://github.com/bocops)
+* Fix user-count (NodeInfo). props [mediaformat](https://github.com/mediaformat)
+
+### 0.13.4 ###
+
+* fix webfinger for email identifiers
+
 ### 0.13.3 ###
 
 * fix: Create and Note should not have the same ActivityPub ID

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/pfefferle/wordpress-activitypub/
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 0.13.3
+ * Version: 0.16.2
  * Author: Matthias Pfefferle
  * Author URI: https://notiz.blog/
  * License: MIT
@@ -21,12 +21,19 @@ require __DIR__ . '/vendor/autoload.php';
  * Initialize plugin
  */
 function init() {
-	\defined( 'ACTIVITYPUB_HASHTAGS_REGEXP' ) || \define( 'ACTIVITYPUB_HASHTAGS_REGEXP', '(?:(?<=\s)|^)#(\w*[A-Za-z_]+\w*)' );
+	\defined( 'ACTIVITYPUB_EXCERPT_LENGTH' ) || \define( 'ACTIVITYPUB_EXCERPT_LENGTH', 400 );
+	\defined( 'ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS' ) || \define( 'ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS', 3 );
+	\defined( 'ACTIVITYPUB_HASHTAGS_REGEXP' ) || \define( 'ACTIVITYPUB_HASHTAGS_REGEXP', '(?:(?<=\s)|(?<=<p>)|(?<=<br>)|^)#([A-Za-z0-9_]+)(?:(?=\s|[[:punct:]]|$))' );
+	\defined( 'ACTIVITYPUB_USERNAME_REGEXP' ) || \define( 'ACTIVITYPUB_USERNAME_REGEXP', '(?:([A-Za-z0-9_-]+)@((?:[A-Za-z0-9_-]+\.)+[A-Za-z]+))' );
 	\defined( 'ACTIVITYPUB_ALLOWED_HTML' ) || \define( 'ACTIVITYPUB_ALLOWED_HTML', '<strong><a><p><ul><ol><li><code><blockquote><pre><img>' );
-	\defined( 'ACTIVITYPUB_CUSTOM_POST_CONTENT' ) || \define( 'ACTIVITYPUB_CUSTOM_POST_CONTENT', "<p><strong>%title%</strong></p>\n\n%content%\n\n<p>%hashtags%</p>\n\n<p>%shortlink%</p>" );
+	\defined( 'ACTIVITYPUB_CUSTOM_POST_CONTENT' ) || \define( 'ACTIVITYPUB_CUSTOM_POST_CONTENT', "<p><strong>[ap_title]</strong></p>\n\n[ap_content]\n\n<p>[ap_hashtags]</p>\n\n<p>[ap_shortlink]</p>" );
+	\define( 'ACTIVITYPUB_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
+	\define( 'ACTIVITYPUB_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
+	\define( 'ACTIVITYPUB_PLUGIN_FILE', plugin_dir_path( __FILE__ ) . '/' . basename( __FILE__ ) );
 
 	require_once \dirname( __FILE__ ) . '/includes/table/followers-list.php';
 	require_once \dirname( __FILE__ ) . '/includes/class-signature.php';
+	require_once \dirname( __FILE__ ) . '/includes/class-webfinger.php';
 	require_once \dirname( __FILE__ ) . '/includes/peer/class-followers.php';
 	require_once \dirname( __FILE__ ) . '/includes/functions.php';
 
@@ -67,26 +74,38 @@ function init() {
 	require_once \dirname( __FILE__ ) . '/includes/class-hashtag.php';
 	\Activitypub\Hashtag::init();
 
+	require_once \dirname( __FILE__ ) . '/includes/class-shortcodes.php';
+	\Activitypub\Shortcodes::init();
+
+	require_once \dirname( __FILE__ ) . '/includes/class-mention.php';
+	\Activitypub\Mention::init();
+
 	require_once \dirname( __FILE__ ) . '/includes/class-debug.php';
 	\Activitypub\Debug::init();
 
 	require_once \dirname( __FILE__ ) . '/includes/class-health-check.php';
 	\Activitypub\Health_Check::init();
 
-	require_once \dirname( __FILE__ ) . '/includes/rest/class-server.php';
-	\add_filter(
-		'wp_rest_server_class',
-		function() {
-			return '\Activitypub\Rest\Server';
-		}
-	);
-
 	if ( \WP_DEBUG ) {
 		require_once \dirname( __FILE__ ) . '/includes/debug.php';
 	}
 }
 \add_action( 'plugins_loaded', '\Activitypub\init' );
 
+/**
+ * Add plugin settings link
+ */
+function plugin_settings_link( $actions ) {
+	$settings_link[] = \sprintf(
+		'<a href="%1s">%2s</a>',
+		\menu_page_url( 'activitypub', false ),
+		\__( 'Settings', 'activitypub' )
+	);
+
+	return \array_merge( $settings_link, $actions );
+}
+\add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), '\Activitypub\plugin_settings_link' );
+
 /**
  * Add rewrite rules
  */
@@ -95,10 +114,12 @@ function add_rewrite_rules() {
 		\add_rewrite_rule( '^.well-known/webfinger', 'index.php?rest_route=/activitypub/1.0/webfinger', 'top' );
 	}
 
-	if ( ! \class_exists( 'Nodeinfo' ) ) {
+	if ( ! \class_exists( 'Nodeinfo' ) || ! (bool) \get_option( 'blog_public', 1 ) ) {
 		\add_rewrite_rule( '^.well-known/nodeinfo', 'index.php?rest_route=/activitypub/1.0/nodeinfo/discovery', 'top' );
 		\add_rewrite_rule( '^.well-known/x-nodeinfo2', 'index.php?rest_route=/activitypub/1.0/nodeinfo2', 'top' );
 	}
+
+	\add_rewrite_endpoint( 'activitypub', EP_AUTHORS | EP_PERMALINK | EP_PAGES );
 }
 \add_action( 'init', '\Activitypub\add_rewrite_rules', 1 );
 

assets/css/activitypub-admin.css

@@ -0,0 +1,141 @@
+.settings_page_activitypub .notice {
+	max-width: 800px;
+	margin: auto;
+	margin-top: 10px;
+}
+
+.activitypub-settings-header {
+	text-align: center;
+	margin: 0 0 1rem;
+	background: #fff;
+	border-bottom: 1px solid #dcdcde;
+}
+
+.activitypub-settings-title-section {
+	display: flex;
+	align-items: center;
+	justify-content: center;
+	clear: both;
+	padding-top: 8px;
+}
+
+.settings_page_activitypub #wpcontent {
+	padding-left: 0;
+}
+
+.activitypub-settings-tabs-wrapper {
+	display: -ms-inline-grid;
+	-ms-grid-columns: 1fr 1fr;
+	vertical-align: top;
+	display: inline-grid;
+	grid-template-columns: 1fr 1fr;
+}
+
+.activitypub-settings-tab.active {
+	box-shadow: inset 0 -3px #3582c4;
+	font-weight: 600;
+}
+
+.activitypub-settings-tab {
+	display: block;
+	text-decoration: none;
+	color: inherit;
+	padding: .5rem 1rem 1rem;
+	margin: 0 1rem;
+	transition: box-shadow .5s ease-in-out;
+}
+
+.wp-header-end {
+	visibility: hidden;
+	margin: -2px 0 0;
+}
+
+summary {
+	cursor: pointer;
+	text-decoration: underline;
+	color: #2271b1;
+}
+
+.activitypub-settings-accordion {
+	border: 1px solid #c3c4c7;
+}
+
+.activitypub-settings-accordion-heading {
+	margin: 0;
+	border-top: 1px solid #c3c4c7;
+	font-size: inherit;
+	line-height: inherit;
+	font-weight: 600;
+	color: inherit;
+}
+
+.activitypub-settings-accordion-heading:first-child {
+	border-top: none;
+}
+
+.activitypub-settings-accordion-panel {
+	margin: 0;
+	padding: 1em 1.5em;
+	background: #fff;
+}
+
+.activitypub-settings-accordion-trigger {
+	background: #fff;
+	border: 0;
+	color: #2c3338;
+	cursor: pointer;
+	display: flex;
+	font-weight: 400;
+	margin: 0;
+	padding: 1em 3.5em 1em 1.5em;
+	min-height: 46px;
+	position: relative;
+	text-align: left;
+	width: 100%;
+	align-items: center;
+	justify-content: space-between;
+	-webkit-user-select: auto;
+	user-select: auto;
+}
+
+.activitypub-settings-accordion-trigger {
+	color: #2c3338;
+	cursor: pointer;
+	font-weight: 400;
+	text-align: left;
+}
+
+.activitypub-settings-accordion-trigger .title {
+	pointer-events: none;
+	font-weight: 600;
+	flex-grow: 1;
+}
+
+.activitypub-settings-accordion-trigger .icon, .activitypub-settings-accordion-viewed .icon {
+	border: solid #50575e medium;
+	border-width: 0 2px 2px 0;
+	height: .5rem;
+	pointer-events: none;
+	position: absolute;
+	right: 1.5em;
+	top: 50%;
+	transform: translateY(-70%) rotate(45deg);
+	width: .5rem;
+}
+
+.activitypub-settings-accordion-trigger[aria-expanded="true"] .icon {
+	transform: translateY(-30%) rotate(-135deg);
+}
+
+.activitypub-settings-accordion-trigger:active, .activitypub-settings-accordion-trigger:hover {
+	background: #f6f7f7;
+}
+
+.activitypub-settings-accordion-trigger:focus {
+	color: #1d2327;
+	border: none;
+	box-shadow: none;
+	outline-offset: -1px;
+	outline: 2px solid #2271b1;
+	background-color: #f6f7f7;
+}

assets/js/activitypub-admin.js

@@ -0,0 +1,20 @@
+jQuery( function( $ ) {
+	// Accordion handling in various areas.
+	$( '.activitypub-settings-accordion' ).on( 'click', '.activitypub-settings-accordion-trigger', function() {
+		var isExpanded = ( 'true' === $( this ).attr( 'aria-expanded' ) );
+
+		if ( isExpanded ) {
+			$( this ).attr( 'aria-expanded', 'false' );
+			$( '#' + $( this ).attr( 'aria-controls' ) ).attr( 'hidden', true );
+		} else {
+			$( this ).attr( 'aria-expanded', 'true' );
+			$( '#' + $( this ).attr( 'aria-controls' ) ).attr( 'hidden', false );
+		}
+	} );
+	
+	$(document).on( 'wp-plugin-install-success', function( event, response ) {
+		setTimeout( function() {
+			$( '.activate-now' ).removeClass( 'thickbox open-plugin-details-modal' );
+		}, 1200 );
+	} );	
+} );

composer.json

@@ -4,7 +4,7 @@
     "type": "wordpress-plugin",
     "require": {
         "php": ">=5.6.0",
-        "composer/installers": "~1.0",
+        "composer/installers": "^1.0 || ^2.0",
         "phpseclib/phpseclib": "~3.0"
     },
     "require-dev": {
@@ -16,6 +16,12 @@
         "yoast/phpunit-polyfills": "^1.0",
         "dealerdirect/phpcodesniffer-composer-installer": "^0.7.1"
     },
+    "config": {
+        "allow-plugins": true
+    },
+    "allow-plugins": {
+        "composer/installers": true
+    },
     "license": "MIT",
     "authors": [
         {
@@ -29,7 +35,7 @@
     "scripts": {
         "test": [
             "composer install",
-            "bin/install-wp-tests.sh wordpress wordpress wordpress",
+            "bin/install-wp-tests.sh activitypub-test root activitypub-test test-db latest true",
             "vendor/bin/phpunit"
         ]
     }

docker-compose-test.yml

@@ -0,0 +1,17 @@
+version: '2'
+services:
+  test-db:
+    image: mysql:5.7
+    environment:
+      MYSQL_DATABASE: activitypub-test
+      MYSQL_ROOT_PASSWORD: activitypub-test
+
+  test-php:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    links:
+      - test-db
+    volumes:
+      - .:/app
+    command: ["composer", "run-script", "test"]

docker-compose.yml

@@ -22,5 +22,6 @@ services:
     restart: always
     environment:
       WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_USER: wordpress
       WORDPRESS_DB_PASSWORD: wordpress
       WORDPRESS_DEBUG: 1

includes/class-activity-dispatcher.php

@@ -23,16 +23,35 @@ class Activity_Dispatcher {
 	 *
 	 * @param \Activitypub\Model\Post $activitypub_post
 	 */
-	public static function send_post_activity( $activitypub_post ) {
+	public static function send_post_activity( Model\Post $activitypub_post ) {
 		// get latest version of post
 		$user_id = $activitypub_post->get_post_author();
 
 		$activitypub_activity = new \Activitypub\Model\Activity( 'Create', \Activitypub\Model\Activity::TYPE_FULL );
-		$activitypub_activity->from_post( $activitypub_post->to_array() );
+		$activitypub_activity->from_post( $activitypub_post );
 
-		foreach ( \Activitypub\get_follower_inboxes( $user_id ) as $inbox => $to ) {
+		$inboxes = \Activitypub\get_follower_inboxes( $user_id );
+
+		$followers_url = \get_rest_url( null, '/activitypub/1.0/users/' . intval( $user_id ) . '/followers' );
+		foreach ( $activitypub_activity->get_cc() as $cc ) {
+			if ( $cc === $followers_url ) {
+				continue;
+			}
+			$inbox = \Activitypub\get_inbox_by_actor( $cc );
+			if ( ! $inbox || \is_wp_error( $inbox ) ) {
+				continue;
+			}
+			// init array if empty
+			if ( ! isset( $inboxes[ $inbox ] ) ) {
+				$inboxes[ $inbox ] = array();
+			}
+			$inboxes[ $inbox ][] = $cc;
+		}
+
+		foreach ( $inboxes as $inbox => $to ) {
+			$to = array_values( array_unique( $to ) );
 			$activitypub_activity->set_to( $to );
-			$activity = $activitypub_activity->to_json(); // phpcs:ignore
+			$activity = $activitypub_activity->to_json();
 
 			\Activitypub\safe_remote_post( $inbox, $activity, $user_id );
 		}
@@ -48,7 +67,7 @@ class Activity_Dispatcher {
 		$user_id = $activitypub_post->get_post_author();
 
 		$activitypub_activity = new \Activitypub\Model\Activity( 'Update', \Activitypub\Model\Activity::TYPE_FULL );
-		$activitypub_activity->from_post( $activitypub_post->to_array() );
+		$activitypub_activity->from_post( $activitypub_post );
 
 		foreach ( \Activitypub\get_follower_inboxes( $user_id ) as $inbox => $to ) {
 			$activitypub_activity->set_to( $to );
@@ -68,7 +87,7 @@ class Activity_Dispatcher {
 		$user_id = $activitypub_post->get_post_author();
 
 		$activitypub_activity = new \Activitypub\Model\Activity( 'Delete', \Activitypub\Model\Activity::TYPE_FULL );
-		$activitypub_activity->from_post( $activitypub_post->to_array() );
+		$activitypub_activity->from_post( $activitypub_post );
 
 		foreach ( \Activitypub\get_follower_inboxes( $user_id ) as $inbox => $to ) {
 			$activitypub_activity->set_to( $to );

includes/class-activitypub.php

@@ -13,7 +13,6 @@ class Activitypub {
 	public static function init() {
 		\add_filter( 'template_include', array( '\Activitypub\Activitypub', 'render_json_template' ), 99 );
 		\add_filter( 'query_vars', array( '\Activitypub\Activitypub', 'add_query_vars' ) );
-		\add_action( 'init', array( '\Activitypub\Activitypub', 'add_rewrite_endpoint' ) );
 		\add_filter( 'pre_get_avatar_data', array( '\Activitypub\Activitypub', 'pre_get_avatar_data' ), 11, 2 );
 
 		// Add support for ActivityPub to custom post types
@@ -23,7 +22,9 @@ class Activitypub {
 			\add_post_type_support( $post_type, 'activitypub' );
 		}
 
-		\add_action( 'transition_post_status', array( '\Activitypub\Activitypub', 'schedule_post_activity' ), 10, 3 );
+		\add_action( 'transition_post_status', array( '\Activitypub\Activitypub', 'schedule_post_activity' ), 33, 3 );
+		\add_action( 'wp_trash_post', array( '\Activitypub\Activitypub', 'trash_post' ), 1 );
+		\add_action( 'untrash_post', array( '\Activitypub\Activitypub', 'untrash_post' ), 1 );
 	}
 
 	/**
@@ -38,12 +39,17 @@ class Activitypub {
 			return $template;
 		}
 
+		// check if user can publish posts
+		if ( \is_author() && ! user_can( \get_the_author_meta( 'ID' ), 'publish_posts' ) ) {
+			return $template;
+		}
+
 		if ( \is_author() ) {
-			$json_template = \dirname( __FILE__ ) . '/../templates/author-json.php';
+			$json_template = ACTIVITYPUB_PLUGIN_DIR . '/templates/author-json.php';
 		} elseif ( \is_singular() ) {
-			$json_template = \dirname( __FILE__ ) . '/../templates/post-json.php';
+			$json_template = ACTIVITYPUB_PLUGIN_DIR . '/templates/post-json.php';
 		} elseif ( \is_home() ) {
-			$json_template = \dirname( __FILE__ ) . '/../templates/blog-json.php';
+			$json_template = ACTIVITYPUB_PLUGIN_DIR . '/templates/blog-json.php';
 		}
 
 		global $wp_query;
@@ -89,13 +95,6 @@ class Activitypub {
 		return $vars;
 	}
 
-	/**
-	 * Add our rewrite endpoint to permalinks and pages.
-	 */
-	public static function add_rewrite_endpoint() {
-		\add_rewrite_endpoint( 'activitypub', EP_AUTHORS | EP_PERMALINK | EP_PAGES );
-	}
-
 	/**
 	 * Schedule Activities.
 	 *
@@ -180,4 +179,26 @@ class Activitypub {
 		}
 		return \get_comment_meta( $comment->comment_ID, 'avatar_url', true );
 	}
+
+	/**
+	 * Store permalink in meta, to send delete Activity
+	 *
+	 * @param string $post_id The Post ID
+	 *
+	 * @return void
+	 */
+	public static function trash_post( $post_id ) {
+		\add_post_meta( $post_id, 'activitypub_canonical_url', \get_permalink( $post_id ), true );
+	}
+
+	/**
+	 * Delete permalink from meta
+	 *
+	 * @param string $post_id The Post ID
+	 *
+	 * @return void
+	 */
+	public static function untrash_post( $post_id ) {
+		\delete_post_meta( $post_id, 'activitypub_canonical_url' );
+	}
 }

includes/class-admin.php

@@ -14,6 +14,7 @@ class Admin {
 		\add_action( 'admin_menu', array( '\Activitypub\Admin', 'admin_menu' ) );
 		\add_action( 'admin_init', array( '\Activitypub\Admin', 'register_settings' ) );
 		\add_action( 'show_user_profile', array( '\Activitypub\Admin', 'add_fediverse_profile' ) );
+		\add_action( 'admin_enqueue_scripts', array( '\Activitypub\Admin', 'enqueue_scripts' ) );
 	}
 
 	/**
@@ -21,7 +22,7 @@ class Admin {
 	 */
 	public static function admin_menu() {
 		$settings_page = \add_options_page(
-			'ActivityPub',
+			'Welcome',
 			'ActivityPub',
 			'manage_options',
 			'activitypub',
@@ -39,7 +40,29 @@ class Admin {
 	 * Load settings page
 	 */
 	public static function settings_page() {
-		\load_template( \dirname( __FILE__ ) . '/../templates/settings.php' );
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		if ( empty( $_GET['tab'] ) ) {
+			$tab = 'welcome';
+		} else {
+			// phpcs:ignore WordPress.Security.NonceVerification.Recommended
+			$tab = sanitize_key( $_GET['tab'] );
+		}
+
+		switch ( $tab ) {
+			case 'settings':
+				\Activitypub\Model\Post::upgrade_post_content_template();
+
+				\load_template( \dirname( __FILE__ ) . '/../templates/settings.php' );
+				break;
+			case 'welcome':
+			default:
+				wp_enqueue_script( 'plugin-install' );
+				add_thickbox();
+				wp_enqueue_script( 'updates' );
+
+				\load_template( \dirname( __FILE__ ) . '/../templates/welcome.php' );
+				break;
+		}
 	}
 
 	/**
@@ -77,6 +100,15 @@ class Admin {
 				'default' => ACTIVITYPUB_CUSTOM_POST_CONTENT,
 			)
 		);
+		\register_setting(
+			'activitypub',
+			'activitypub_max_image_attachments',
+			array(
+				'type' => 'integer',
+				'description' => \__( 'Number of images to attach to posts.', 'activitypub' ),
+				'default' => ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS,
+			)
+		);
 		\register_setting(
 			'activitypub',
 			'activitypub_object_type',
@@ -100,15 +132,6 @@ class Admin {
 				'default' => 0,
 			)
 		);
-		\register_setting(
-			'activitypub',
-			'activitypub_allowed_html',
-			array(
-				'type' => 'string',
-				'description' => \__( 'List of HTML elements that are allowed in activities.', 'activitypub' ),
-				'default' => ACTIVITYPUB_ALLOWED_HTML,
-			)
-		);
 		\register_setting(
 			'activitypub',
 			'activitypub_support_post_types',
@@ -122,23 +145,7 @@ class Admin {
 	}
 
 	public static function add_settings_help_tab() {
-		\get_current_screen()->add_help_tab(
+		require_once \dirname( __FILE__ ) . '/help.php';
-			array(
-				'id'      => 'overview',
-				'title'   => \__( 'Overview', 'activitypub' ),
-				'content' =>
-					'<p>' . \__( 'ActivityPub is a decentralized social networking protocol based on the ActivityStreams 2.0 data format. ActivityPub is an official W3C recommended standard published by the W3C Social Web Working Group. It provides a client to server API for creating, updating and deleting content, as well as a federated server to server API for delivering notifications and subscribing to content.', 'activitypub' ) . '</p>',
-			)
-		);
-
-		\get_current_screen()->set_help_sidebar(
-			'<p><strong>' . \__( 'For more information:', 'activitypub' ) . '</strong></p>' .
-			'<p>' . \__( '<a href="https://activitypub.rocks/">Test Suite</a>', 'activitypub' ) . '</p>' .
-			'<p>' . \__( '<a href="https://www.w3.org/TR/activitypub/">W3C Spec</a>', 'activitypub' ) . '</p>' .
-			'<p>' . \__( '<a href="https://github.com/pfefferle/wordpress-activitypub/issues">Give us feedback</a>', 'activitypub' ) . '</p>' .
-			'<hr />' .
-			'<p>' . \__( '<a href="https://notiz.blog/donate">Donate</a>', 'activitypub' ) . '</p>'
-		);
 	}
 
 	public static function add_followers_list_help_tab() {
@@ -147,8 +154,15 @@ class Admin {
 
 	public static function add_fediverse_profile( $user ) {
 		?>
-		<h2><?php \esc_html_e( 'Fediverse', 'activitypub' ); ?></h2>
+		<h2 id="activitypub"><?php \esc_html_e( 'ActivityPub', 'activitypub' ); ?></h2>
 		<?php
 		\Activitypub\get_identifier_settings( $user->ID );
 	}
+
+	public static function enqueue_scripts( $hook_suffix ) {
+		if ( false !== strpos( $hook_suffix, 'activitypub' ) ) {
+			wp_enqueue_style( 'activitypub-admin-styles', plugins_url( 'assets/css/activitypub-admin.css', ACTIVITYPUB_PLUGIN_FILE ), array(), '1.0.0' );
+			wp_enqueue_script( 'activitypub-admin-styles', plugins_url( 'assets/js/activitypub-admin.js', ACTIVITYPUB_PLUGIN_FILE ), array( 'jquery' ), '1.0.0', false );
+		}
+	}
 }

includes/class-debug.php

@@ -17,13 +17,16 @@ class Debug {
 	}
 
 	public static function log_remote_post_responses( $response, $url, $body, $user_id ) {
+		// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log, WordPress.PHP.DevelopmentFunctions.error_log_print_r
 		\error_log( "Request to: {$url} with response: " . \print_r( $response, true ) );
 	}
 
 	public static function write_log( $log ) {
 		if ( \is_array( $log ) || \is_object( $log ) ) {
+			// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log, WordPress.PHP.DevelopmentFunctions.error_log_print_r
 			\error_log( \print_r( $log, true ) );
 		} else {
+			// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
 			\error_log( $log );
 		}
 	}

includes/class-hashtag.php

@@ -12,24 +12,24 @@ class Hashtag {
 	 */
 	public static function init() {
 		if ( '1' === \get_option( 'activitypub_use_hashtags', '1' ) ) {
-			\add_filter( 'wp_insert_post', array( '\Activitypub\Hashtag', 'insert_post' ), 99, 2 );
+			\add_filter( 'wp_insert_post', array( '\Activitypub\Hashtag', 'insert_post' ), 10, 2 );
-			\add_filter( 'the_content', array( '\Activitypub\Hashtag', 'the_content' ), 99, 2 );
+			\add_filter( 'the_content', array( '\Activitypub\Hashtag', 'the_content' ), 10, 2 );
 		}
 	}
 
 	/**
 	 * Filter to save #tags as real WordPress tags
 	 *
-	 * @param int $id the rev-id
+	 * @param int     $id the rev-id
-	 * @param array $data the post-data as array
+	 * @param WP_Post $post the post
 	 *
 	 * @return
 	 */
-	public static function insert_post( $id, $data ) {
+	public static function insert_post( $id, $post ) {
-		if ( \preg_match_all( '/' . ACTIVITYPUB_HASHTAGS_REGEXP . '/i', $data->post_content, $match ) ) {
+		if ( \preg_match_all( '/' . ACTIVITYPUB_HASHTAGS_REGEXP . '/i', $post->post_content, $match ) ) {
 			$tags = \implode( ', ', $match[1] );
 
-			\wp_add_post_tags( $data->post_parent, $tags );
+			\wp_add_post_tags( $post->post_parent, $tags );
 		}
 
 		return $id;
@@ -43,8 +43,33 @@ class Hashtag {
 	 * @return string the filtered post-content
 	 */
 	public static function the_content( $the_content ) {
+		$protected_tags = array();
+		$protect = function( $m ) use ( &$protected_tags ) {
+			$c = count( $protected_tags );
+			$protect = '!#!#PROTECT' . $c . '#!#!';
+			$protected_tags[ $protect ] = $m[0];
+			return $protect;
+		};
+		$the_content = preg_replace_callback(
+			'#<!\[CDATA\[.*?\]\]>#is',
+			$protect,
+			$the_content
+		);
+		$the_content = preg_replace_callback(
+			'#<(pre|code|textarea|style)\b[^>]*>.*?</\1[^>]*>#is',
+			$protect,
+			$the_content
+		);
+		$the_content = preg_replace_callback(
+			'#<[^>]+>#i',
+			$protect,
+			$the_content
+		);
+
 		$the_content = \preg_replace_callback( '/' . ACTIVITYPUB_HASHTAGS_REGEXP . '/i', array( '\Activitypub\Hashtag', 'replace_with_links' ), $the_content );
 
+		$the_content = str_replace( array_reverse( array_keys( $protected_tags ) ), array_reverse( array_values( $protected_tags ) ), $the_content );
+
 		return $the_content;
 	}
 

includes/class-health-check.php

@@ -15,6 +15,7 @@ class Health_Check {
 	 */
 	public static function init() {
 		\add_filter( 'site_status_tests', array( '\Activitypub\Health_Check', 'add_tests' ) );
+		\add_filter( 'debug_information', array( '\Activitypub\Health_Check', 'debug_information' ) );
 	}
 
 	public static function add_tests( $tests ) {
@@ -198,58 +199,37 @@ class Health_Check {
 	 * @return boolean|WP_Error
 	 */
 	public static function is_webfinger_endpoint_accessible() {
-		$user      = \wp_get_current_user();
+		$user    = \wp_get_current_user();
-		$webfinger = \Activitypub\get_webfinger_resource( $user->ID );
+		$account = \Activitypub\get_webfinger_resource( $user->ID );
 
-		$url = \wp_parse_url( \home_url(), \PHP_URL_SCHEME ) . '://' . \wp_parse_url( \home_url(), \PHP_URL_HOST );
+		$url = \Activitypub\Webfinger::resolve( $account );
-
+		if ( \is_wp_error( $url ) ) {
-		if ( \wp_parse_url( \home_url(), \PHP_URL_PORT ) ) {
+			$health_messages = array(
-			$url .= ':' . \wp_parse_url( \home_url(), \PHP_URL_PORT );
+				'webfinger_url_not_accessible' => \sprintf(
-		}
-
-		$url = \trailingslashit( $url ) . '.well-known/webfinger';
-
-		$url = \add_query_arg( 'resource', 'acct:' . $webfinger, $url );
-
-		// try to access author URL
-		$response = \wp_remote_get(
-			$url,
-			array(
-				'headers' => array( 'Accept' => 'application/activity+json' ),
-				'redirection' => 0,
-			)
-		);
-
-		if ( \is_wp_error( $response ) ) {
-			return new \WP_Error(
-				'webfinger_url_not_accessible',
-				\sprintf(
 					// translators: %s: Author URL
 					\__(
 						'<p>Your WebFinger endpoint <code>%s</code> is not accessible. Please check your WordPress setup or permalink structure.</p>',
 						'activitypub'
 					),
-					$url
+					$url->get_error_data()
-				)
+				),
-			);
+				'webfinger_url_invalid_response' => \sprintf(
-		}
-
-		$response_code = \wp_remote_retrieve_response_code( $response );
-
-		// check if response is JSON
-		$body = \wp_remote_retrieve_body( $response );
-
-		if ( ! \is_string( $body ) || ! \is_array( \json_decode( $body, true ) ) ) {
-			return new \WP_Error(
-				'webfinger_url_not_accessible',
-				\sprintf(
 					// translators: %s: Author URL
 					\__(
 						'<p>Your WebFinger endpoint <code>%s</code> does not return valid JSON for <code>application/jrd+json</code>.</p>',
 						'activitypub'
 					),
-					$url
+					$url->get_error_data()
-				)
+				),
+			);
+			$message = null;
+			if ( isset( $health_messages[ $url->get_error_code() ] ) ) {
+				$message = $health_messages[ $url->get_error_code() ];
+			}
+			return new \WP_Error(
+				$url->get_error_code(),
+				$message,
+				$url->get_error_data()
 			);
 		}
 
@@ -287,4 +267,30 @@ class Health_Check {
 
 		return $link;
 	}
+
+	/**
+	 * Static function for generating site debug data when required.
+	 *
+	 * @param array $info The debug information to be added to the core information page.
+	 * @return array The filtered informations
+	 */
+	public static function debug_information( $info ) {
+		$info['activitypub'] = array(
+			'label'  => __( 'ActivityPub', 'activitypub' ),
+			'fields' => array(
+				'webfinger' => array(
+					'label'   => __( 'WebFinger Resource', 'activitypub' ),
+					'value'   => \Activitypub\Webfinger::get_user_resource( wp_get_current_user()->ID ),
+					'private' => true,
+				),
+				'author_url' => array(
+					'label'   => __( 'Author URL', 'activitypub' ),
+					'value'   => get_author_posts_url( wp_get_current_user()->ID ),
+					'private' => true,
+				),
+			),
+		);
+
+		return $info;
+	}
 }

includes/class-mention.php

@@ -0,0 +1,97 @@
+<?php
+namespace Activitypub;
+
+/**
+ * ActivityPub Mention Class
+ *
+ * @author Alex Kirk
+ */
+class Mention {
+	/**
+	 * Initialize the class, registering WordPress hooks
+	 */
+	public static function init() {
+		\add_filter( 'the_content', array( '\Activitypub\Mention', 'the_content' ), 99, 2 );
+		\add_filter( 'activitypub_extract_mentions', array( '\Activitypub\Mention', 'extract_mentions' ), 99, 2 );
+	}
+
+	/**
+	 * Filter to replace the mentions in the content with links
+	 *
+	 * @param string $the_content the post-content
+	 *
+	 * @return string the filtered post-content
+	 */
+	public static function the_content( $the_content ) {
+		$protected_tags = array();
+		$protect = function( $m ) use ( &$protected_tags ) {
+			$c = count( $protected_tags );
+			$protect = '!#!#PROTECT' . $c . '#!#!';
+			$protected_tags[ $protect ] = $m[0];
+			return $protect;
+		};
+		$the_content = preg_replace_callback(
+			'#<!\[CDATA\[.*?\]\]>#is',
+			$protect,
+			$the_content
+		);
+		$the_content = preg_replace_callback(
+			'#<(pre|code|textarea|style)\b[^>]*>.*?</\1[^>]*>#is',
+			$protect,
+			$the_content
+		);
+		$the_content = preg_replace_callback(
+			'#<a.*?href=[^>]+>.*?</a>#i',
+			$protect,
+			$the_content
+		);
+
+		$the_content = \preg_replace_callback( '/@' . ACTIVITYPUB_USERNAME_REGEXP . '/', array( '\Activitypub\Mention', 'replace_with_links' ), $the_content );
+
+		$the_content = str_replace( array_reverse( array_keys( $protected_tags ) ), array_reverse( array_values( $protected_tags ) ), $the_content );
+
+		return $the_content;
+	}
+
+	/**
+	 * A callback for preg_replace to build the user links
+	 *
+	 * @param array $result the preg_match results
+	 * @return string the final string
+	 */
+	public static function replace_with_links( $result ) {
+		$metadata = \ActivityPub\get_remote_metadata_by_actor( $result[0] );
+		if ( ! is_wp_error( $metadata ) && ! empty( $metadata['url'] ) ) {
+			$username = ltrim( $result[0], '@' );
+			if ( ! empty( $metadata['name'] ) ) {
+				$username = $metadata['name'];
+			}
+			if ( ! empty( $metadata['preferredUsername'] ) ) {
+				$username = $metadata['preferredUsername'];
+			}
+			$username = '@<span>' . $username . '</span>';
+			return \sprintf( '<a rel="mention" class="u-url mention" href="%s">%s</a>', $metadata['url'], $username );
+		}
+
+		return $result[0];
+	}
+
+	/**
+	 * Extract the mentions from the post_content.
+	 *
+	 * @param array  $mentions The already found mentions.
+	 * @param string $post_content The post content.
+	 * @return mixed The discovered mentions.
+	 */
+	public static function extract_mentions( $mentions, $post_content ) {
+		\preg_match_all( '/@' . ACTIVITYPUB_USERNAME_REGEXP . '/i', $post_content, $matches );
+		foreach ( $matches[0] as $match ) {
+			$link = \Activitypub\Webfinger::resolve( $match );
+			if ( ! is_wp_error( $link ) ) {
+				$mentions[ $match ] = $link;
+			}
+		}
+		return $mentions;
+
+	}
+}

includes/class-shortcodes.php

@@ -0,0 +1,524 @@
+<?php
+namespace Activitypub;
+
+class Shortcodes {
+	/**
+	 * Class constructor, registering WordPress then shortcodes
+	 *
+	 * @param WP_Post  $post    A WordPress Post Object
+	 */
+	public static function init() {
+		foreach ( get_class_methods( 'Activitypub\Shortcodes' ) as $shortcode ) {
+			if ( 'init' !== $shortcode ) {
+				add_shortcode( 'ap_' . $shortcode, array( 'Activitypub\Shortcodes', $shortcode ) );
+			}
+		}
+	}
+
+	/**
+	 * Generates output for the ap_hashtags shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function hashtags( $atts, $content, $tag ) {
+		$post_id = get_the_ID();
+
+		if ( ! $post_id ) {
+			return '';
+		}
+
+		$tags = \get_the_tags( $post_id );
+
+		if ( ! $tags ) {
+			return '';
+		}
+
+		$hash_tags = array();
+
+		foreach ( $tags as $tag ) {
+			$hash_tags[] = \sprintf(
+				'<a rel="tag" class="u-tag u-category" href="%s">#%s</a>',
+				\get_tag_link( $tag ),
+				$tag->slug
+			);
+		}
+
+		return \implode( ' ', $hash_tags );
+	}
+
+	/**
+	 * Generates output for the ap_title shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function title( $atts, $content, $tag ) {
+		$post_id = get_the_ID();
+
+		if ( ! $post_id ) {
+			return '';
+		}
+
+		return \get_the_title( $post_id );
+
+	}
+
+	/**
+	 * Generates output for the ap_excerpt shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function excerpt( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$atts = shortcode_atts(
+			array( 'length' => ACTIVITYPUB_EXCERPT_LENGTH ),
+			$atts,
+			$tag
+		);
+
+		$excerpt_length = intval( $atts['length'] );
+
+		if ( 0 === $excerpt_length ) {
+			$excerpt_length = ACTIVITYPUB_EXCERPT_LENGTH;
+		}
+
+		$excerpt = \get_post_field( 'post_excerpt', $post );
+
+		if ( '' === $excerpt ) {
+
+			$content = \get_post_field( 'post_content', $post );
+
+			// An empty string will make wp_trim_excerpt do stuff we do not want.
+			if ( '' !== $content ) {
+
+				$excerpt = \strip_shortcodes( $content );
+
+				/** This filter is documented in wp-includes/post-template.php */
+				$excerpt = \apply_filters( 'the_content', $excerpt );
+				$excerpt = \str_replace( ']]>', ']]>', $excerpt );
+
+			}
+		}
+
+		// Strip out any remaining tags.
+		$excerpt = \wp_strip_all_tags( $excerpt );
+
+		/** This filter is documented in wp-includes/formatting.php */
+		$excerpt_more = \apply_filters( 'excerpt_more', ' [...]' );
+		$excerpt_more_len = strlen( $excerpt_more );
+
+		// We now have a excerpt, but we need to check it's length, it may be longer than we want for two reasons:
+		//
+		//   * The user has entered a manual excerpt which is longer that what we want.
+		//   * No manual excerpt exists so we've used the content which might be longer than we want.
+		//
+		// Either way, let's trim it up if we need too.  Also, don't forget to take into account the more indicator
+		// as part of the total length.
+		//
+
+		// Setup a variable to hold the current excerpts length.
+		$current_excerpt_length = strlen( $excerpt );
+
+		// Setup a variable to keep track of our target length.
+		$target_excerpt_length = $excerpt_length - $excerpt_more_len;
+
+		// Setup a variable to keep track of the current max length.
+		$current_excerpt_max = $target_excerpt_length;
+
+		// This is a loop since we can't calculate word break the string after 'the_excpert' filter has run (we would break
+		// all kinds of html tags), so we have to cut the excerpt down a bit at a time until we hit our target length.
+		while ( $current_excerpt_length > $target_excerpt_length && $current_excerpt_max > 0 ) {
+			// Trim the excerpt based on wordwrap() positioning.
+			// Note: we're using <br> as the linebreak just in case there are any newlines existing in the excerpt from the user.
+			//       There won't be any <br> left after we've run wp_strip_all_tags() in the code above, so they're
+			//       safe to use here.  It won't be included in the final excerpt as the substr() will trim it off.
+			$excerpt = substr( $excerpt, 0, strpos( wordwrap( $excerpt, $current_excerpt_max, '<br>' ), '<br>' ) );
+
+			// If something went wrong, or we're in a language that wordwrap() doesn't understand,
+			// just chop it off and don't worry about breaking in the middle of a word.
+			if ( strlen( $excerpt ) > $excerpt_length - $excerpt_more_len ) {
+				$excerpt = substr( $excerpt, 0, $current_excerpt_max );
+			}
+
+			// Add in the more indicator.
+			$excerpt = $excerpt . $excerpt_more;
+
+			// Run it through the excerpt filter which will add some html tags back in.
+			$excerpt_filtered = apply_filters( 'the_excerpt', $excerpt );
+
+			// Now set the current excerpt length to this new filtered length.
+			$current_excerpt_length = strlen( $excerpt_filtered );
+
+			// Check to see if we're over the target length.
+			if ( $current_excerpt_length > $target_excerpt_length ) {
+				// If so, remove 20 characters from the current max and run the loop again.
+				$current_excerpt_max = $current_excerpt_max - 20;
+			}
+		}
+
+		return \apply_filters( 'the_excerpt', $excerpt );
+	}
+
+	/**
+	 * Generates output for the ap_content shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function content( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$atts = shortcode_atts(
+			array( 'apply_filters' => 'yes' ),
+			$atts,
+			$tag
+		);
+
+		$content = \get_post_field( 'post_content', $post );
+
+		if ( 'yes' === $atts['apply_filters'] ) {
+			$content = \apply_filters( 'the_content', $content );
+		} else {
+			$content = do_blocks( $content );
+			$content = wptexturize( $content );
+			$content = wp_filter_content_tags( $content );
+		}
+
+		return $content;
+	}
+
+	/**
+	 * Generates output for the ap_permalink shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function permalink( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$atts = shortcode_atts(
+			array(
+				'type' => 'url',
+			),
+			$atts,
+			$tag
+		);
+
+		if ( 'url' === $atts['type'] ) {
+			return \esc_url( \get_permalink( $post->ID ) );
+		}
+
+		return \sprintf( '<a href="%1$s">%1$s</a>', \esc_url( \get_permalink( $post->ID ) ) );
+	}
+
+	/**
+	 * Generates output for the ap_shortlink shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function shortlink( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$atts = shortcode_atts(
+			array(
+				'type' => 'url',
+			),
+			$atts,
+			$tag
+		);
+
+		if ( 'url' === $atts['type'] ) {
+			return \esc_url( \wp_get_shortlink( $post->ID ) );
+		}
+
+		return \sprintf( '<a href="%1$s">%1$s</a>', \esc_url( \wp_get_shortlink( $post->ID ) ) );
+	}
+
+	/**
+	 * Generates output for the ap_image shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function image( $atts, $content, $tag ) {
+		$post_id = get_the_ID();
+
+		if ( ! $post_id ) {
+			return '';
+		}
+
+		$atts = shortcode_atts(
+			array(
+				'type' => 'full',
+			),
+			$atts,
+			$tag
+		);
+
+		$size = 'full';
+
+		if ( in_array(
+			$atts['type'],
+			array( 'thumbnail', 'medium', 'large', 'full' ),
+			true
+		) ) {
+			$size = $atts['type'];
+		}
+
+		$image = \get_the_post_thumbnail_url( $post_id, $size );
+
+		if ( ! $image ) {
+			return '';
+		}
+
+		return \esc_url( $image );
+	}
+
+	/**
+	 * Generates output for the ap_hashcats shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function hashcats( $atts, $content, $tag ) {
+		$post_id = get_the_ID();
+
+		if ( ! $post_id ) {
+			return '';
+		}
+
+		$categories = \get_the_category( $post_id );
+
+		if ( ! $categories ) {
+			return '';
+		}
+
+		$hash_tags = array();
+
+		foreach ( $categories as $category ) {
+			$hash_tags[] = \sprintf( '<a rel="tag" class="u-tag u-category" href="%s">#%s</a>', \get_category_link( $category ), $category->slug );
+		}
+
+		return \implode( ' ', $hash_tags );
+	}
+
+	/**
+	 * Generates output for the ap_author shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function author( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$name = \get_the_author_meta( 'display_name', $post->post_author );
+
+		if ( ! $name ) {
+			return '';
+		}
+
+		return $name;
+	}
+
+	/**
+	 * Generates output for the ap_authorurl shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function authorurl( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$url = \get_the_author_meta( 'user_url', $post->post_author );
+
+		if ( ! $url ) {
+			return '';
+		}
+
+		return \esc_url( $url );
+	}
+
+	/**
+	 * Generates output for the ap_blogurl shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function blogurl( $atts, $content, $tag ) {
+		return \esc_url( \get_bloginfo( 'url' ) );
+	}
+
+	/**
+	 * Generates output for the ap_blogname shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function blogname( $atts, $content, $tag ) {
+		return \get_bloginfo( 'name' );
+	}
+
+	/**
+	 * Generates output for the ap_blogdesc shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function blogdesc( $atts, $content, $tag ) {
+		return \get_bloginfo( 'description' );
+	}
+
+	/**
+	 * Generates output for the ap_date shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function date( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$datetime = \get_post_datetime( $post );
+		$dateformat = \get_option( 'date_format' );
+		$timeformat = \get_option( 'time_format' );
+
+		$date = $datetime->format( $dateformat );
+
+		if ( ! $date ) {
+			return '';
+		}
+
+		return $date;
+	}
+
+	/**
+	 * Generates output for the ap_time shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function time( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$datetime = \get_post_datetime( $post );
+		$dateformat = \get_option( 'date_format' );
+		$timeformat = \get_option( 'time_format' );
+
+		$date = $datetime->format( $timeformat );
+
+		if ( ! $date ) {
+			return '';
+		}
+
+		return $date;
+	}
+
+	/**
+	 * Generates output for the ap_datetime shortcode
+	 *
+	 * @param array  $atts      shortcode attributes
+	 * @param string $content   shortcode content
+	 * @param string $tag       shortcode tag name
+	 *
+	 * @return string
+	 */
+	public static function datetime( $atts, $content, $tag ) {
+		$post = get_post();
+
+		if ( ! $post ) {
+			return '';
+		}
+
+		$datetime = \get_post_datetime( $post );
+		$dateformat = \get_option( 'date_format' );
+		$timeformat = \get_option( 'time_format' );
+
+		$date = $datetime->format( $dateformat . ' @ ' . $timeformat );
+
+		if ( ! $date ) {
+			return '';
+		}
+
+		return $date;
+	}
+}

includes/class-signature.php

@@ -83,7 +83,7 @@ class Signature {
 		\update_user_meta( $user_id, 'magic_sig_public_key', $detail['key'] );
 	}
 
-	public static function generate_signature( $user_id, $url, $date, $digest = null ) {
+	public static function generate_signature( $user_id, $http_method, $url, $date, $digest = null ) {
 		$key = self::get_private_key( $user_id );
 
 		$url_parts = \wp_parse_url( $url );
@@ -102,9 +102,9 @@ class Signature {
 		}
 
 		if ( ! empty( $digest ) ) {
-			$signed_string = "(request-target): post $path\nhost: $host\ndate: $date\ndigest: SHA-256=$digest";
+			$signed_string = "(request-target): $http_method $path\nhost: $host\ndate: $date\ndigest: SHA-256=$digest";
 		} else {
-			$signed_string = "(request-target): post $path\nhost: $host\ndate: $date";
+			$signed_string = "(request-target): $http_method $path\nhost: $host\ndate: $date";
 		}
 
 		$signature = null;

includes/class-webfinger.php

@@ -0,0 +1,84 @@
+<?php
+namespace Activitypub;
+
+/**
+ * ActivityPub WebFinger Class
+ *
+ * @author Matthias Pfefferle
+ *
+ * @see https://webfinger.net/
+ */
+class Webfinger {
+	/**
+	 * Returns a users WebFinger "resource"
+	 *
+	 * @param int $user_id
+	 *
+	 * @return string The user-resource
+	 */
+	public static function get_user_resource( $user_id ) {
+		// use WebFinger plugin if installed
+		if ( \function_exists( '\get_webfinger_resource' ) ) {
+			return \get_webfinger_resource( $user_id, false );
+		}
+
+		$user = \get_user_by( 'id', $user_id );
+
+		return $user->user_login . '@' . \wp_parse_url( \home_url(), \PHP_URL_HOST );
+	}
+
+	public static function resolve( $account ) {
+		if ( ! preg_match( '/^@?' . ACTIVITYPUB_USERNAME_REGEXP . '$/i', $account, $m ) ) {
+			return null;
+		}
+		$transient_key = 'activitypub_resolve_' . ltrim( $account, '@' );
+
+		$link = \get_transient( $transient_key );
+		if ( $link ) {
+			return $link;
+		}
+
+		$url = \add_query_arg( 'resource', 'acct:' . ltrim( $account, '@' ), 'https://' . $m[2] . '/.well-known/webfinger' );
+		if ( ! \wp_http_validate_url( $url ) ) {
+			$response = new \WP_Error( 'invalid_webfinger_url', null, $url );
+			\set_transient( $transient_key, $response, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
+			return $response;
+		}
+
+		// try to access author URL
+		$response = \wp_remote_get(
+			$url,
+			array(
+				'headers' => array( 'Accept' => 'application/activity+json' ),
+				'redirection' => 0,
+				'timeout' => 2,
+			)
+		);
+
+		if ( \is_wp_error( $response ) ) {
+			$link = new \WP_Error( 'webfinger_url_not_accessible', null, $url );
+			\set_transient( $transient_key, $link, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
+			return $link;
+		}
+
+		$body = \wp_remote_retrieve_body( $response );
+		$body = \json_decode( $body, true );
+
+		if ( empty( $body['links'] ) ) {
+			$link = new \WP_Error( 'webfinger_url_invalid_response', null, $url );
+			\set_transient( $transient_key, $link, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
+			return $link;
+		}
+
+		foreach ( $body['links'] as $link ) {
+			if ( 'self' === $link['rel'] && 'application/activity+json' === $link['type'] ) {
+				\set_transient( $transient_key, $link['href'], WEEK_IN_SECONDS );
+				return $link['href'];
+			}
+		}
+
+		$link = new \WP_Error( 'webfinger_url_no_activity_pub', null, $body );
+		\set_transient( $transient_key, $link, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
+		return $link;
+	}
+}

includes/functions.php

@@ -35,7 +35,7 @@ function get_context() {
 function safe_remote_post( $url, $body, $user_id ) {
 	$date = \gmdate( 'D, d M Y H:i:s T' );
 	$digest = \Activitypub\Signature::generate_digest( $body );
-	$signature = \Activitypub\Signature::generate_signature( $user_id, $url, $date, $digest );
+	$signature = \Activitypub\Signature::generate_signature( $user_id, 'post', $url, $date, $digest );
 
 	$wp_version = \get_bloginfo( 'version' );
 	$user_agent = \apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . \get_bloginfo( 'url' ) );
@@ -63,12 +63,12 @@ function safe_remote_post( $url, $body, $user_id ) {
 
 function safe_remote_get( $url, $user_id ) {
 	$date = \gmdate( 'D, d M Y H:i:s T' );
-	$signature = \Activitypub\Signature::generate_signature( $user_id, $url, $date );
+	$signature = \Activitypub\Signature::generate_signature( $user_id, 'get', $url, $date );
 
 	$wp_version = \get_bloginfo( 'version' );
 	$user_agent = \apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . \get_bloginfo( 'url' ) );
 	$args = array(
-		'timeout' => 100,
+		'timeout' => apply_filters( 'activitypub_remote_get_timeout', 100 ),
 		'limit_response_size' => 1048576,
 		'redirection' => 3,
 		'user-agent' => "$user_agent; ActivityPub",
@@ -95,48 +95,64 @@ function safe_remote_get( $url, $user_id ) {
  * @return string The user-resource
  */
 function get_webfinger_resource( $user_id ) {
-	// use WebFinger plugin if installed
+	return \Activitypub\Webfinger::get_user_resource( $user_id );
-	if ( \function_exists( '\get_webfinger_resource' ) ) {
-		return \get_webfinger_resource( $user_id, false );
-	}
-
-	$user = \get_user_by( 'id', $user_id );
-
-	return $user->user_login . '@' . \wp_parse_url( \home_url(), \PHP_URL_HOST );
 }
 
 /**
  * [get_metadata_by_actor description]
  *
- * @param sting $actor
+ * @param string $actor
  *
  * @return array
  */
 function get_remote_metadata_by_actor( $actor ) {
-	$metadata = \get_transient( 'activitypub_' . $actor );
+	$pre = apply_filters( 'pre_get_remote_metadata_by_actor', false, $actor );
+	if ( $pre ) {
+		return $pre;
+	}
+	if ( preg_match( '/^@?' . ACTIVITYPUB_USERNAME_REGEXP . '$/i', $actor ) ) {
+		$actor = Webfinger::resolve( $actor );
+	}
+
+	if ( ! $actor ) {
+		return null;
+	}
+
+	if ( is_wp_error( $actor ) ) {
+		return $actor;
+	}
+
+	$transient_key = 'activitypub_' . $actor;
+	$metadata = \get_transient( $transient_key );
 
 	if ( $metadata ) {
 		return $metadata;
 	}
 
 	if ( ! \wp_http_validate_url( $actor ) ) {
-		return new \WP_Error( 'activitypub_no_valid_actor_url', \__( 'The "actor" is no valid URL', 'activitypub' ), $actor );
+		$metadata = new \WP_Error( 'activitypub_no_valid_actor_url', \__( 'The "actor" is no valid URL', 'activitypub' ), $actor );
+		\set_transient( $transient_key, $metadata, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
+		return $metadata;
 	}
 
 	$user = \get_users(
 		array(
 			'number' => 1,
-			'who'    => 'authors',
+			'capability__in' => array( 'publish_posts' ),
 			'fields' => 'ID',
 		)
 	);
 
 	// we just need any user to generate a request signature
 	$user_id = \reset( $user );
-
+	$short_timeout = function() {
+		return 3;
+	};
+	add_filter( 'activitypub_remote_get_timeout', $short_timeout );
 	$response = \Activitypub\safe_remote_get( $actor, $user_id );
-
+	remove_filter( 'activitypub_remote_get_timeout', $short_timeout );
 	if ( \is_wp_error( $response ) ) {
+		\set_transient( $transient_key, $response, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
 		return $response;
 	}
 
@@ -144,10 +160,12 @@ function get_remote_metadata_by_actor( $actor ) {
 	$metadata = \json_decode( $metadata, true );
 
 	if ( ! $metadata ) {
-		return new \WP_Error( 'activitypub_invalid_json', \__( 'No valid JSON data', 'activitypub' ), $actor );
+		$metadata = new \WP_Error( 'activitypub_invalid_json', \__( 'No valid JSON data', 'activitypub' ), $actor );
+		\set_transient( $transient_key, $metadata, HOUR_IN_SECONDS ); // Cache the error for a shorter period.
+		return $metadata;
 	}
 
-	\set_transient( 'activitypub_' . $actor, $metadata, WEEK_IN_SECONDS );
+	\set_transient( $transient_key, $metadata, WEEK_IN_SECONDS );
 
 	return $metadata;
 }
@@ -236,7 +254,7 @@ function get_identifier_settings( $user_id ) {
 			<td>
 				<p><code><?php echo \esc_html( \Activitypub\get_webfinger_resource( $user_id ) ); ?></code> or <code><?php echo \esc_url( \get_author_posts_url( $user_id ) ); ?></code></p>
 				<?php // translators: the webfinger resource ?>
-				<p class="description"><?php \printf( \esc_html__( 'Try to follow "@%s" in the Mastodon/Friendica search field.', 'activitypub' ), \esc_html( \Activitypub\get_webfinger_resource( $user_id ) ) ); ?></p>
+				<p class="description"><?php \printf( \esc_html__( 'Try to follow "@%s" by searching for it on Mastodon,Friendica & Co.', 'activitypub' ), \esc_html( \Activitypub\get_webfinger_resource( $user_id ) ) ); ?></p>
 			</td>
 		</tr>
 	</tbody>

includes/help.php

@@ -0,0 +1,77 @@
+<?php
+
+\get_current_screen()->add_help_tab(
+	array(
+		'id'      => 'template-tags',
+		'title'   => \__( 'Template Tags', 'activitypub' ),
+		'content' =>
+			'<p>' . __( 'The following Template Tags are available:', 'activitypub' ) . '</p>' .
+			'<dl>' .
+				'<dt><code>[ap_title]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s title.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_content apply_filters="yes"]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s content. With <code>apply_filters</code> you can decide if filters should be applied or not (default is <code>yes</code>). The values can be <code>yes</code> or <code>no</code>. <code>apply_filters</code> attribute is optional.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_excerpt lenght="400"]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s excerpt (default 400 chars). <code>length</code> attribute is optional.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_permalink type="url"]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s permalink. <code>type</code> can be either: <code>url</code> or <code>html</code> (an &lt;a /&gt; tag). <code>type</code> attribute is optional.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_shortlink type="url"]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s shortlink. <code>type</code> can be either <code>url</code> or <code>html</code> (an &lt;a /&gt; tag). I can recommend <a href="https://wordpress.org/plugins/hum/" target="_blank">Hum</a>, to prettify the Shortlinks. <code>type</code> attribute is optional.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_hashtags]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s tags as hashtags.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_hashcats]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s categories as hashtags.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_image type=full]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The URL for the post\'s featured image, defaults to full size. The type attribute can be any of the following: <code>thumbnail</code>, <code>medium</code>, <code>large</code>, <code>full</code>. <code>type</code> attribute is optional.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_author]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The author\'s name.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_authorurl]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The URL to the author\'s profile page.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_date]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s date.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_time]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s time.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_datetime]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The post\'s date/time formated as "date @ time".', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_blogurl]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The URL to the site.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_blogname]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The name of the site.', 'activitypub' ), 'default' ) . '</dd>' .
+				'<dt><code>[ap_blogdesc]</code></dt>' .
+				'<dd>' . \wp_kses( __( 'The description of the site.', 'activitypub' ), 'default' ) . '</dd>' .
+			'</dl>' .
+			'<p>' . __( 'You may also use any Shortcode normally available to you on your site, however be aware that Shortcodes may significantly increase the size of your content depending on what they do.', 'activitypub' ) . '</p>' .
+			'<p>' . __( 'Note: the old Template Tags are now deprecated and automatically converted to the new ones.', 'activitypub' ) . '</p>' .
+			'<p>' . \wp_kses( \__( '<a href="https://github.com/pfefferle/wordpress-activitypub/issues/new" target="_blank">Let me know</a> if you miss a Template Tag.', 'activitypub' ), 'activitypub' ) . '</p>',
+	)
+);
+
+\get_current_screen()->add_help_tab(
+	array(
+		'id'      => 'glossar',
+		'title'   => \__( 'Glossar', 'activitypub' ),
+		'content' =>
+			'<p><h2>' . \__( 'Fediverse', 'activitypub' ) . '</h2></p>' .
+			'<p>' . \__( 'The Fediverse is a new word made of two words: "federation" + "universe"', 'activitypub' ) . '</p>' .
+			'<p>' . \__( 'It is a federated social network running on free open software on a myriad of computers across the globe. Many independent servers are interconnected and allow people to interact with one another. There\'s no one central site: you choose a server to register. This ensures some decentralization and sovereignty of data. Fediverse (also called Fedi) has no built-in advertisements, no tricky algorithms, no one big corporation dictating the rules. Instead we have small cozy communities of like-minded people. Welcome!', 'activitypub' ) . '</p>' .
+			'<p>' . \__( 'For more informations please visit <a href="https://fediverse.party/" target="_blank">fediverse.party</a>', 'activitypub' ) . '</p>' .
+			'<p><h2>' . \__( 'ActivityPub', 'activitypub' ) . '</h2></p>' .
+			'<p>' . \__( 'ActivityPub is a decentralized social networking protocol based on the ActivityStreams 2.0 data format. ActivityPub is an official W3C recommended standard published by the W3C Social Web Working Group. It provides a client to server API for creating, updating and deleting content, as well as a federated server to server API for delivering notifications and subscribing to content.', 'activitypub' ) . '</p>' .
+			'<p><h2>' . \__( 'WebFinger', 'activitypub' ) . '</h2></p>' .
+			'<p>' . \__( 'WebFinger is used to discover information about people or other entities on the Internet that are identified by a URI using standard Hypertext Transfer Protocol (HTTP) methods over a secure transport. A WebFinger resource returns a JavaScript Object Notation (JSON) object describing the entity that is queried. The JSON object is referred to as the JSON Resource Descriptor (JRD).', 'activitypub' ) . '</p>' .
+			'<p>' . \__( 'For a person, the type of information that might be discoverable via WebFinger includes a personal profile address, identity service, telephone number, or preferred avatar. For other entities on the Internet, a WebFinger resource might return JRDs containing link relations that enable a client to discover, for example, that a printer can print in color on A4 paper, the physical location of a server, or other static information.', 'activitypub' ) . '</p>' .
+			'<p>' . \__( 'On Mastodon [and other Plattforms], user profiles can be hosted either locally on the same website as yours, or remotely on a completely different website. The same username may be used on a different domain. Therefore, a Mastodon user\'s full mention consists of both the username and the domain, in the form <code>@username@domain</code>. In practical terms, <code>@user@example.com</code> is not the same as <code>@user@example.org</code>. If the domain is not included, Mastodon will try to find a local user named <code>@username</code>. However, in order to deliver to someone over ActivityPub, the <code>@username@domain</code> mention is not enough – mentions must be translated to an HTTPS URI first, so that the remote actor\'s inbox and outbox can be found. (This paragraph is copied from the <a href="https://docs.joinmastodon.org/spec/webfinger/" target="_blank">Mastodon Documentation</a>)', 'activitypub' ) . '</p>' .
+			'<p>' . \__( 'For more informations please visit <a href="https://webfinger.net/" target="_blank">webfinger.net</a>', 'activitypub' ) . '</p>' .
+			'<p><h2>' . \__( 'NodeInfo', 'activitypub' ) . '</h2></p>' .
+			'<p>' . \__( 'NodeInfo is an effort to create a standardized way of exposing metadata about a server running one of the distributed social networks. The two key goals are being able to get better insights into the user base of distributed social networking and the ability to build tools that allow users to choose the best fitting software and server for their needs.', 'activitypub' ) . '</p>' .
+			'<p>' . \__( 'For more informations please visit <a href="http://nodeinfo.diaspora.software/" target="_blank">nodeinfo.diaspora.software</a>', 'activitypub' ) . '</p>',
+	)
+);
+
+\get_current_screen()->set_help_sidebar(
+	'<p><strong>' . \__( 'For more information:', 'activitypub' ) . '</strong></p>' .
+	'<p>' . \__( '<a href="https://wordpress.org/support/plugin/activitypub/">Get support</a>', 'activitypub' ) . '</p>' .
+	'<p>' . \__( '<a href="https://github.com/pfefferle/wordpress-activitypub/issues">Report an issue</a>', 'activitypub' ) . '</p>' .
+	'<hr />' .
+	'<p>' . \__( '<a href="https://notiz.blog/donate">Donate</a>', 'activitypub' ) . '</p>'
+);

includes/model/class-activity.php

@@ -45,20 +45,28 @@ class Activity {
 		}
 	}
 
-	public function from_post( $object ) {
+	public function from_post( Post $post ) {
-		$this->object = $object;
+		$this->object = $post->to_array();
+
 		if ( isset( $object['published'] ) ) {
 			$this->published = $object['published'];
 		}
+		$this->cc = array( \get_rest_url( null, '/activitypub/1.0/users/' . intval( $post->get_post_author() ) . '/followers' ) );
 
-		if ( isset( $object['attributedTo'] ) ) {
+		if ( isset( $this->object['attributedTo'] ) ) {
-			$this->actor = $object['attributedTo'];
+			$this->actor = $this->object['attributedTo'];
+		}
+
+		foreach ( $post->get_tags() as $tag ) {
+			if ( 'Mention' === $tag['type'] ) {
+				$this->cc[] = $tag['href'];
+			}
 		}
 
 		$type = \strtolower( $this->type );
 
-		if ( isset( $object['id'] ) ) {
+		if ( isset( $this->object['id'] ) ) {
-			$this->id = add_query_arg( 'activity', $type, $object['id'] );
+			$this->id = add_query_arg( 'activity', $type, $this->object['id'] );
 		}
 	}
 
@@ -75,7 +83,7 @@ class Activity {
 	}
 
 	public function to_array() {
-		$array = \get_object_vars( $this );
+		$array = array_filter( \get_object_vars( $this ) );
 
 		if ( $this->context ) {
 			$array = array( '@context' => $this->context ) + $array;

includes/model/class-post.php

@@ -7,31 +7,110 @@ namespace Activitypub\Model;
  * @author Matthias Pfefferle
  */
 class Post {
+	/**
+	 * The WordPress Post Object.
+	 *
+	 * @var WP_Post
+	 */
 	private $post;
+
+	/**
+	 * The Post Author.
+	 *
+	 * @var string
+	 */
 	private $post_author;
+
+	/**
+	 * The Object ID.
+	 *
+	 * @var string
+	 */
 	private $id;
+
+	/**
+	 * The Object Summary.
+	 *
+	 * @var string
+	 */
 	private $summary;
+
+	/**
+	 * The Object Summary
+	 *
+	 * @var string
+	 */
 	private $content;
+
+	/**
+	 * The Object Attachments. This is usually a list of Images.
+	 *
+	 * @var array
+	 */
 	private $attachments;
+
+	/**
+	 * The Object Tags. This is usually the list of used Hashtags.
+	 *
+	 * @var array
+	 */
 	private $tags;
-	private $object_type;
 
-	public function __construct( $post = null ) {
+	/**
+	 * The Onject Type
+	 *
+	 * @var string
+	 */
+	private $object_type = 'Note';
+
+	/**
+	 * The Allowed Tags, used in the content.
+	 *
+	 * @var array
+	 */
+	private $allowed_tags = array(
+		'a' => array(
+			'href' => array(),
+			'title' => array(),
+			'class' => array(),
+			'rel' => array(),
+		),
+		'br' => array(),
+		'p' => array(
+			'class' => array(),
+		),
+		'span' => array(
+			'class' => array(),
+		),
+		'div' => array(
+			'class' => array(),
+		),
+	);
+
+	/**
+	 * Constructor
+	 *
+	 * @param WP_Post $post
+	 */
+	public function __construct( $post ) {
 		$this->post = \get_post( $post );
-
-		$this->post_author = $this->post->post_author;
-		$this->id          = $this->generate_id();
-		$this->summary     = $this->generate_the_title();
-		$this->content     = $this->generate_the_content();
-		$this->attachments = $this->generate_attachments();
-		$this->tags        = $this->generate_tags();
-		$this->object_type = $this->generate_object_type();
 	}
 
+	/**
+	 * Magic function to implement getter and setter
+	 *
+	 * @param string $method
+	 * @param string $params
+	 *
+	 * @return void
+	 */
 	public function __call( $method, $params ) {
 		$var = \strtolower( \substr( $method, 4 ) );
 
 		if ( \strncasecmp( $method, 'get', 3 ) === 0 ) {
+			if ( empty( $this->$var ) && ! empty( $this->post->$var ) ) {
+				return $this->post->$var;
+			}
 			return $this->$var;
 		}
 
@@ -40,74 +119,112 @@ class Post {
 		}
 	}
 
+	/**
+	 * Converts this Object into an Array.
+	 *
+	 * @return array
+	 */
 	public function to_array() {
 		$post = $this->post;
 
 		$array = array(
-			'id' => $this->id,
+			'id' => $this->get_id(),
-			'type' => $this->object_type,
+			'type' => $this->get_object_type(),
 			'published' => \gmdate( 'Y-m-d\TH:i:s\Z', \strtotime( $post->post_date_gmt ) ),
 			'attributedTo' => \get_author_posts_url( $post->post_author ),
-			'summary' => $this->summary,
+			'summary' => $this->get_summary(),
 			'inReplyTo' => null,
-			'content' => $this->content,
+			'content' => $this->get_content(),
 			'contentMap' => array(
-				\strstr( \get_locale(), '_', true ) => $this->content,
+				\strstr( \get_locale(), '_', true ) => $this->get_content(),
 			),
 			'to' => array( 'https://www.w3.org/ns/activitystreams#Public' ),
 			'cc' => array( 'https://www.w3.org/ns/activitystreams#Public' ),
-			'attachment' => $this->attachments,
+			'attachment' => $this->get_attachments(),
-			'tag' => $this->tags,
+			'tag' => $this->get_tags(),
 		);
 
-		return \apply_filters( 'activitypub_post', $array );
+		return \apply_filters( 'activitypub_post', $array, $this->post );
 	}
 
+	/**
+	 * Converts this Object into a JSON String
+	 *
+	 * @return string
+	 */
 	public function to_json() {
 		return \wp_json_encode( $this->to_array(), \JSON_HEX_TAG | \JSON_HEX_AMP | \JSON_HEX_QUOT );
 	}
 
-	public function generate_id() {
+	/**
-		$post      = $this->post;
+	 * Returns the ID of an Activity Object
-		$permalink = \get_permalink( $post );
+	 *
+	 * @return string
+	 */
+	public function get_id() {
+		if ( $this->id ) {
+			return $this->id;
+		}
 
-		// replace 'trashed' for delete activity
+		$post = $this->post;
-		return \str_replace( '__trashed', '', $permalink );
+
+		if ( 'trash' === get_post_status( $post ) ) {
+			$permalink = \get_post_meta( $post->ID, 'activitypub_canonical_url', true );
+		} else {
+			$permalink = \get_permalink( $post );
+		}
+
+		$this->id = $permalink;
+
+		return $permalink;
 	}
 
-	public function generate_attachments() {
+	/**
-		$max_images = \apply_filters( 'activitypub_max_images', 3 );
+	 * Returns a list of Image Attachments
+	 *
+	 * @return array
+	 */
+	public function get_attachments() {
+		if ( $this->attachments ) {
+			return $this->attachments;
+		}
+
+		$max_images = intval( \apply_filters( 'activitypub_max_image_attachments', \get_option( 'activitypub_max_image_attachments', ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS ) ) );
 
 		$images = array();
 
 		// max images can't be negative or zero
 		if ( $max_images <= 0 ) {
-			$max_images = 1;
+			return $images;
 		}
 
 		$id = $this->post->ID;
 
 		$image_ids = array();
+
 		// list post thumbnail first if this post has one
 		if ( \function_exists( 'has_post_thumbnail' ) && \has_post_thumbnail( $id ) ) {
 			$image_ids[] = \get_post_thumbnail_id( $id );
 			$max_images--;
 		}
-		// then list any image attachments
+
-		$query = new \WP_Query(
+		if ( $max_images > 0 ) {
-			array(
+			// then list any image attachments
-				'post_parent' => $id,
+			$query = new \WP_Query(
-				'post_status' => 'inherit',
+				array(
-				'post_type' => 'attachment',
+					'post_parent' => $id,
-				'post_mime_type' => 'image',
+					'post_status' => 'inherit',
-				'order' => 'ASC',
+					'post_type' => 'attachment',
-				'orderby' => 'menu_order ID',
+					'post_mime_type' => 'image',
-				'posts_per_page' => $max_images,
+					'order' => 'ASC',
-			)
+					'orderby' => 'menu_order ID',
-		);
+					'posts_per_page' => $max_images,
-		foreach ( $query->get_posts() as $attachment ) {
+				)
-			if ( ! \in_array( $attachment->ID, $image_ids, true ) ) {
+			);
-				$image_ids[] = $attachment->ID;
+			foreach ( $query->get_posts() as $attachment ) {
+				if ( ! \in_array( $attachment->ID, $image_ids, true ) ) {
+					$image_ids[] = $attachment->ID;
+				}
 			}
 		}
 
@@ -132,10 +249,21 @@ class Post {
 			}
 		}
 
+		$this->attachments = $images;
+
 		return $images;
 	}
 
-	public function generate_tags() {
+	/**
+	 * Returns a list of Tags, used in the Post
+	 *
+	 * @return array
+	 */
+	public function get_tags() {
+		if ( $this->tags ) {
+			return $this->tags;
+		}
+
 		$tags = array();
 
 		$post_tags = \get_the_tags( $this->post->ID );
@@ -150,18 +278,33 @@ class Post {
 			}
 		}
 
+		$mentions = apply_filters( 'activitypub_extract_mentions', array(), $this->post->post_content, $this );
+		if ( $mentions ) {
+			foreach ( $mentions as $mention => $url ) {
+				$tag = array(
+					'type' => 'Mention',
+					'href' => $url,
+					'name' => $mention,
+				);
+				$tags[] = $tag;
+			}
+		}
+
+		$this->tags = $tags;
+
 		return $tags;
 	}
 
 	/**
 	 * Returns the as2 object-type for a given post
 	 *
-	 * @param string $type the object-type
-	 * @param Object $post the post-object
-	 *
 	 * @return string the object-type
 	 */
-	public function generate_object_type() {
+	public function get_object_type() {
+		if ( $this->object_type ) {
+			return $this->object_type;
+		}
+
 		if ( 'wordpress-post-format' !== \get_option( 'activitypub_object_type', 'note' ) ) {
 			return \ucfirst( \get_option( 'activitypub_object_type', 'note' ) );
 		}
@@ -215,146 +358,104 @@ class Post {
 				break;
 		}
 
+		$this->object_type = $object_type;
+
 		return $object_type;
 	}
 
-	public function generate_the_content() {
+	/**
-		$post = $this->post;
+	 * Returns the content for the ActivityPub Item.
-		$content = $this->get_post_content_template();
+	 *
+	 * @return string the content
+	 */
+	public function get_content() {
+		global $post;
 
-		$content = \str_replace( '%title%', \get_the_title( $post->ID ), $content );
+		if ( $this->content ) {
-		$content = \str_replace( '%excerpt%', $this->get_the_post_excerpt(), $content );
+			return $this->content;
-		$content = \str_replace( '%content%', $this->get_the_post_content(), $content );
-		$content = \str_replace( '%permalink%', $this->get_the_post_link( 'permalink' ), $content );
-		$content = \str_replace( '%shortlink%', $this->get_the_post_link( 'shortlink' ), $content );
-		$content = \str_replace( '%hashtags%', $this->get_the_post_hashtags(), $content );
-		// backwards compatibility
-		$content = \str_replace( '%tags%', $this->get_the_post_hashtags(), $content );
-
-		$content = \trim( \preg_replace( '/[\r\n]{2,}/', '', $content ) );
-
-		$filtered_content = \apply_filters( 'activitypub_the_content', $content, $this->post );
-		$decoded_content = \html_entity_decode( $filtered_content, \ENT_QUOTES, 'UTF-8' );
-
-		$allowed_html = \apply_filters( 'activitypub_allowed_html', \get_option( 'activitypub_allowed_html', ACTIVITYPUB_ALLOWED_HTML ) );
-
-		if ( $allowed_html ) {
-			return \strip_tags( $decoded_content, $allowed_html );
 		}
 
-		return $decoded_content;
+		// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
+		$post    = $this->post;
+		$content = $this->get_post_content_template();
+
+		// Fill in the shortcodes.
+		setup_postdata( $post );
+		$content = do_shortcode( $content );
+		wp_reset_postdata();
+
+		$content = \wpautop( \wp_kses( $content, $this->allowed_tags ) );
+
+		$filtered_content = \apply_filters( 'activitypub_the_content', $content, $post );
+		$decoded_content = \html_entity_decode( $filtered_content, \ENT_QUOTES, 'UTF-8' );
+
+		$content = \trim( \preg_replace( '/[\n\r\t]/', '', $content ) );
+
+		$this->content = $content;
+
+		return $content;
 	}
 
+	/**
+	 * Gets the template to use to generate the content of the activitypub item.
+	 *
+	 * @return string the template
+	 */
 	public function get_post_content_template() {
 		if ( 'excerpt' === \get_option( 'activitypub_post_content_type', 'content' ) ) {
-			return "%excerpt%\n\n<p>%permalink%</p>";
+			return "[ap_excerpt]\n\n[ap_permalink]";
 		}
 
 		if ( 'title' === \get_option( 'activitypub_post_content_type', 'content' ) ) {
-			return "<p><strong>%title%</strong></p>\n\n<p>%permalink%</p>";
+			return "[ap_title]\n\n[ap_permalink]";
 		}
 
 		if ( 'content' === \get_option( 'activitypub_post_content_type', 'content' ) ) {
-			return "%content%\n\n<p>%hashtags%</p>\n\n<p>%permalink%</p>";
+			return "[ap_content]\n\n[ap_hashtags]\n\n[ap_permalink]";
 		}
 
-		return \get_option( 'activitypub_custom_post_content', ACTIVITYPUB_CUSTOM_POST_CONTENT );
+		// Upgrade from old template codes to shortcodes.
+		$content = self::upgrade_post_content_template();
+
+		return $content;
 	}
 
 	/**
-	 * Get the excerpt for a post for use outside of the loop.
+	 * Updates the custom template to use shortcodes instead of the deprecated templates.
 	 *
-	 * @param int     Optional excerpt length.
+	 * @return string the updated template content
-	 *
-	 * @return string The excerpt.
 	 */
-	public function get_the_post_excerpt( $excerpt_length = 400 ) {
+	public static function upgrade_post_content_template() {
-		$post = $this->post;
+		// Get the custom template.
+		$old_content = \get_option( 'activitypub_custom_post_content', ACTIVITYPUB_CUSTOM_POST_CONTENT );
 
-		$excerpt = \get_post_field( 'post_excerpt', $post );
+		// If the old content exists but is a blank string, we're going to need a flag to updated it even
+		// after setting it to the default contents.
+		$need_update = false;
 
-		if ( '' === $excerpt ) {
+		// If the old contents is blank, use the defaults.
-
+		if ( '' === $old_content ) {
-			$content = \get_post_field( 'post_content', $post );
+			$old_content = ACTIVITYPUB_CUSTOM_POST_CONTENT;
-
+			$need_update = true;
-			// An empty string will make wp_trim_excerpt do stuff we do not want.
-			if ( '' !== $content ) {
-
-				$excerpt = \strip_shortcodes( $content );
-
-				/** This filter is documented in wp-includes/post-template.php */
-				$excerpt = \apply_filters( 'the_content', $excerpt );
-				$excerpt = \str_replace( ']]>', ']]>', $excerpt );
-
-				$excerpt_length = \apply_filters( 'excerpt_length', $excerpt_length );
-
-				/** This filter is documented in wp-includes/formatting.php */
-				$excerpt_more = \apply_filters( 'excerpt_more', ' [...]' );
-
-				$excerpt = \wp_trim_words( $excerpt, $excerpt_length, $excerpt_more );
-			}
 		}
 
-		return \apply_filters( 'the_excerpt', $excerpt );
+		// Set the new content to be the old content.
-	}
+		$content = $old_content;
 
-	/**
+		// Convert old templates to shortcodes.
-	 * Get the content for a post for use outside of the loop.
+		$content = \str_replace( '%title%', '[ap_title]', $content );
-	 *
+		$content = \str_replace( '%excerpt%', '[ap_excerpt]', $content );
-	 * @return string The content.
+		$content = \str_replace( '%content%', '[ap_content]', $content );
-	 */
+		$content = \str_replace( '%permalink%', '[ap_permalink type="html"]', $content );
-	public function get_the_post_content() {
+		$content = \str_replace( '%shortlink%', '[ap_shortlink type="html"]', $content );
-		$post = $this->post;
+		$content = \str_replace( '%hashtags%', '[ap_hashtags]', $content );
+		$content = \str_replace( '%tags%', '[ap_hashtags]', $content );
 
-		$content = \get_post_field( 'post_content', $post );
+		// Store the new template if required.
-
+		if ( $content !== $old_content || $need_update ) {
-		return \apply_filters( 'the_content', $content );
+			\update_option( 'activitypub_custom_post_content', $content );
-	}
-
-	/**
-	 * Adds a backlink to the post/summary content
-	 *
-	 * @param string  $content
-	 * @param WP_Post $post
-	 *
-	 * @return string
-	 */
-	public function get_the_post_link( $type = 'permalink' ) {
-		$post = $this->post;
-
-		if ( 'shortlink' === $type ) {
-			$link = \esc_url( \wp_get_shortlink( $post->ID ) );
-		} elseif ( 'permalink' === $type ) {
-			$link = \esc_url( \get_permalink( $post->ID ) );
-		} else {
-			return '';
 		}
 
-		return \sprintf( '<a href="%1$s">%1$s</a>', $link );
+		return $content;
-	}
-
-	/**
-	 * Adds all tags as hashtags to the post/summary content
-	 *
-	 * @param string  $content
-	 * @param WP_Post $post
-	 *
-	 * @return string
-	 */
-	public function get_the_post_hashtags() {
-		$post = $this->post;
-		$tags = \get_the_tags( $post->ID );
-
-		if ( ! $tags ) {
-			return '';
-		}
-
-		$hash_tags = array();
-
-		foreach ( $tags as $tag ) {
-			$hash_tags[] = \sprintf( '<a rel="tag" class="u-tag u-category" href="%s">#%s</a>', \get_tag_link( $tag ), $tag->slug );
-		}
-
-		return \implode( ' ', $hash_tags );
 	}
 }

includes/rest/class-followers.php

@@ -101,6 +101,9 @@ class Followers {
 		$params['user_id'] = array(
 			'required' => true,
 			'type' => 'integer',
+			'validate_callback' => function( $param, $request, $key ) {
+				return user_can( $param, 'publish_posts' );
+			},
 		);
 
 		return $params;

includes/rest/class-following.php

@@ -99,6 +99,9 @@ class Following {
 		$params['user_id'] = array(
 			'required' => true,
 			'type' => 'integer',
+			'validate_callback' => function( $param, $request, $key ) {
+				return user_can( $param, 'publish_posts' );
+			},
 		);
 
 		return $params;

includes/rest/class-inbox.php

@@ -33,7 +33,7 @@ class Inbox {
 				array(
 					'methods'             => \WP_REST_Server::EDITABLE,
 					'callback'            => array( '\Activitypub\Rest\Inbox', 'shared_inbox_post' ),
-					'args'                => self::shared_inbox_request_parameters(),
+					'args'                => self::shared_inbox_post_parameters(),
 					'permission_callback' => '__return_true',
 				),
 			)
@@ -46,12 +46,13 @@ class Inbox {
 				array(
 					'methods'             => \WP_REST_Server::EDITABLE,
 					'callback'            => array( '\Activitypub\Rest\Inbox', 'user_inbox_post' ),
-					'args'                => self::user_inbox_request_parameters(),
+					'args'                => self::user_inbox_post_parameters(),
 					'permission_callback' => '__return_true',
 				),
 				array(
 					'methods'             => \WP_REST_Server::READABLE,
 					'callback'            => array( '\Activitypub\Rest\Inbox', 'user_inbox_get' ),
+					'args'                => self::user_inbox_get_parameters(),
 					'permission_callback' => '__return_true',
 				),
 			)
@@ -162,7 +163,6 @@ class Inbox {
 	public static function shared_inbox_post( $request ) {
 		$data = $request->get_params();
 		$type = $request->get_param( 'type' );
-
 		$users = self::extract_recipients( $data );
 
 		if ( ! $users ) {
@@ -197,7 +197,7 @@ class Inbox {
 	 *
 	 * @return array list of parameters
 	 */
-	public static function user_inbox_request_parameters() {
+	public static function user_inbox_get_parameters() {
 		$params = array();
 
 		$params['page'] = array(
@@ -207,6 +207,32 @@ class Inbox {
 		$params['user_id'] = array(
 			'required' => true,
 			'type' => 'integer',
+			'validate_callback' => function( $param, $request, $key ) {
+				return user_can( $param, 'publish_posts' );
+			},
+		);
+
+		return $params;
+	}
+
+	/**
+	 * The supported parameters
+	 *
+	 * @return array list of parameters
+	 */
+	public static function user_inbox_post_parameters() {
+		$params = array();
+
+		$params['page'] = array(
+			'type' => 'integer',
+		);
+
+		$params['user_id'] = array(
+			'required' => true,
+			'type' => 'integer',
+			'validate_callback' => function( $param, $request, $key ) {
+				return user_can( $param, 'publish_posts' );
+			},
 		);
 
 		$params['id'] = array(
@@ -245,7 +271,7 @@ class Inbox {
 	 *
 	 * @return array list of parameters
 	 */
-	public static function shared_inbox_request_parameters() {
+	public static function shared_inbox_post_parameters() {
 		$params = array();
 
 		$params['page'] = array(
@@ -408,6 +434,16 @@ class Inbox {
 	public static function handle_create( $object, $user_id ) {
 		$meta = \Activitypub\get_remote_metadata_by_actor( $object['actor'] );
 
+		if ( ! isset( $object['object']['inReplyTo'] ) ) {
+			return;
+		}
+
+		// check if Activity is public or not
+		if ( ! self::is_activity_public( $object ) ) {
+			// @todo maybe send email
+			return;
+		}
+
 		$comment_post_id = \url_to_postid( $object['object']['inReplyTo'] );
 
 		// save only replys and reactions
@@ -444,21 +480,53 @@ class Inbox {
 		\add_action( 'check_comment_flood', 'check_comment_flood_db', 10, 4 );
 	}
 
+	/**
+	 * Extract recipient URLs from Activity object
+	 *
+	 * @param  array $data
+	 *
+	 * @return array The list of user URLs
+	 */
 	public static function extract_recipients( $data ) {
-		$recipients = array();
+		$recipient_items = array();
-		$users = array();
 
 		foreach ( array( 'to', 'bto', 'cc', 'bcc', 'audience' ) as $i ) {
 			if ( array_key_exists( $i, $data ) ) {
-				$recipients = array_merge( $recipients, $data[ $i ] );
+				$recipient_items = array_merge( $recipient_items, $data[ $i ] );
 			}
 
 			if ( array_key_exists( $i, $data['object'] ) ) {
-				$recipients = array_merge( $recipients, $data[ $i ] );
+				$recipient_items = array_merge( $recipient_items, $data[ $i ] );
 			}
 		}
 
-		$recipients = array_unique( $recipients );
+		$recipients = array();
+
+		// flatten array
+		foreach ( $recipient_items as $recipient ) {
+			if ( is_array( $recipient ) ) {
+				// check if recipient is an object
+				if ( array_key_exists( 'id', $recipient ) ) {
+					$recipients[] = $recipient['id'];
+				}
+			} else {
+				$recipients[] = $recipient;
+			}
+		}
+
+		return array_unique( $recipients );
+	}
+
+	/**
+	 * Get local user recipients
+	 *
+	 * @param  array $data
+	 *
+	 * @return array The list of local users
+	 */
+	public static function get_recipients( $data ) {
+		$recipients = self::extract_recipients( $data );
+		$users = array();
 
 		foreach ( $recipients as $recipient ) {
 			$user_id = \Activitypub\url_to_authorid( $recipient );
@@ -472,4 +540,16 @@ class Inbox {
 
 		return $users;
 	}
+
+	/**
+	 * Check if passed Activity is Public
+	 *
+	 * @param array $data
+	 * @return boolean
+	 */
+	public static function is_activity_public( $data ) {
+		$recipients = self::extract_recipients( $data );
+
+		return in_array( 'https://www.w3.org/ns/activitystreams#Public', $recipients, true );
+	}
 }

includes/rest/class-nodeinfo.php

@@ -95,10 +95,6 @@ class Nodeinfo {
 			'outbound' => array(),
 		);
 
-		$nodeinfo['metadata'] = array(
-			'email' => \get_option( 'admin_email' ),
-		);
-
 		return new \WP_REST_Response( $nodeinfo, 200 );
 	}
 
@@ -120,13 +116,24 @@ class Nodeinfo {
 			'version' => \get_bloginfo( 'version' ),
 		);
 
-		$users = \count_users();
+		$users = \get_users(
+			array(
+				'capability__in' => array( 'publish_posts' ),
+			)
+		);
+
+		if ( is_array( $users ) ) {
+			$users = count( $users );
+		} else {
+			$users = 1;
+		}
+
 		$posts = \wp_count_posts();
 		$comments = \wp_count_comments();
 
 		$nodeinfo['usage'] = array(
 			'users' => array(
-				'total' => (int) $users['total_users'],
+				'total' => (int) $users,
 			),
 			'localPosts' => (int) $posts->publish,
 			'localComments' => (int) $comments->approved,
@@ -140,10 +147,6 @@ class Nodeinfo {
 			'outbound' => array(),
 		);
 
-		$nodeinfo['metadata'] = array(
-			'email' => \get_option( 'admin_email' ),
-		);
-
 		return new \WP_REST_Response( $nodeinfo, 200 );
 	}
 

includes/rest/class-outbox.php

@@ -43,6 +43,7 @@ class Outbox {
 	public static function user_outbox_get( $request ) {
 		$user_id = $request->get_param( 'user_id' );
 		$author  = \get_user_by( 'ID', $user_id );
+		$post_types = \get_option( 'activitypub_support_post_types', array( 'post', 'page' ) );
 
 		if ( ! $author ) {
 			return new \WP_Error(
@@ -72,9 +73,15 @@ class Outbox {
 		$json->actor = \get_author_posts_url( $user_id );
 		$json->type = 'OrderedCollectionPage';
 		$json->partOf = \get_rest_url( null, "/activitypub/1.0/users/$user_id/outbox" ); // phpcs:ignore
+		$json->totalItems = 0; // phpcs:ignore
 
-		$count_posts = \wp_count_posts();
+		// phpcs:ignore
-		$json->totalItems = \intval( $count_posts->publish ); // phpcs:ignore
+		$json->totalItems = 0;
+
+		foreach ( $post_types as $post_type ) {
+			$count_posts = \wp_count_posts( $post_type );
+			$json->totalItems += \intval( $count_posts->publish ); // phpcs:ignore
+		}
 
 		$json->first = \add_query_arg( 'page', 1, $json->partOf ); // phpcs:ignore
 		$json->last  = \add_query_arg( 'page', \ceil ( $json->totalItems / 10 ), $json->partOf ); // phpcs:ignore
@@ -89,14 +96,14 @@ class Outbox {
 					'posts_per_page' => 10,
 					'author' => $user_id,
 					'offset' => ( $page - 1 ) * 10,
-					'post_type' => 'post',
+					'post_type' => $post_types,
 				)
 			);
 
 			foreach ( $posts as $post ) {
 				$activitypub_post = new \Activitypub\Model\Post( $post );
 				$activitypub_activity = new \Activitypub\Model\Activity( 'Create', \Activitypub\Model\Activity::TYPE_NONE );
-				$activitypub_activity->from_post( $activitypub_post->to_array() );
+				$activitypub_activity->from_post( $activitypub_post );
 				$json->orderedItems[] = $activitypub_activity->to_array(); // phpcs:ignore
 			}
 		}
@@ -131,6 +138,9 @@ class Outbox {
 		$params['user_id'] = array(
 			'required' => true,
 			'type' => 'integer',
+			'validate_callback' => function( $param, $request, $key ) {
+				return user_can( $param, 'publish_posts' );
+			},
 		);
 
 		return $params;

includes/rest/class-server.php

@@ -1,35 +0,0 @@
-<?php
-namespace Activitypub\Rest;
-
-/**
- * Custom (hopefully temporary) ActivityPub Rest Server
- *
- * @author Matthias Pfefferle
- */
-class Server extends \WP_REST_Server {
-	/**
-	 * Overwrite dispatch function to quick fix missing subtype featur
-	 *
-	 * @see https://core.trac.wordpress.org/ticket/49404
-	 *
-	 * @param WP_REST_Request $request Request to attempt dispatching.
-	 * @return WP_REST_Response Response returned by the callback.
-	 */
-	public function dispatch( $request ) {
-		$content_type = $request->get_content_type();
-
-		if ( ! $content_type ) {
-			return parent::dispatch( $request );
-		}
-
-		// check for content-sub-types like 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"'
-		if ( \preg_match( '/application\/([a-zA-Z+_-]+\+)json/', $content_type['value'] ) ) {
-			// Signature Verification requires headers to be intact
-		}
-
-		// make request filterable
-		$request = \apply_filters( 'activitypub_pre_dispatch_request', $request );
-
-		return parent::dispatch( $request );
-	}
-}

includes/rest/class-webfinger.php

@@ -44,15 +44,14 @@ class Webfinger {
 	public static function webfinger( $request ) {
 		$resource = $request->get_param( 'resource' );
 
-		$matches = array();
+		if ( \strpos( $resource, '@' ) === false ) {
-		$matched = \preg_match( '/^acct:([^@]+)@(.+)$/', $resource, $matches );
-
-		if ( ! $matched ) {
 			return new \WP_Error( 'activitypub_unsupported_resource', \__( 'Resource is invalid', 'activitypub' ), array( 'status' => 400 ) );
 		}
 
-		$resource_identifier = $matches[1];
+		$resource = \str_replace( 'acct:', '', $resource );
-		$resource_host = $matches[2];
+
+		$resource_identifier = \substr( $resource, 0, \strrpos( $resource, '@' ) );
+		$resource_host = \substr( \strrchr( $resource, '@' ), 1 );
 
 		if ( \wp_parse_url( \home_url( '/' ), \PHP_URL_HOST ) !== $resource_host ) {
 			return new \WP_Error( 'activitypub_wrong_host', \__( 'Resource host does not match blog host', 'activitypub' ), array( 'status' => 404 ) );
@@ -60,7 +59,7 @@ class Webfinger {
 
 		$user = \get_user_by( 'login', \esc_sql( $resource_identifier ) );
 
-		if ( ! $user ) {
+		if ( ! $user || ! user_can( $user, 'publish_posts' ) ) {
 			return new \WP_Error( 'activitypub_user_not_found', \__( 'User not found', 'activitypub' ), array( 'status' => 404 ) );
 		}
 
@@ -97,7 +96,7 @@ class Webfinger {
 		$params['resource'] = array(
 			'required' => true,
 			'type' => 'string',
-			'pattern' => '^acct:([^@]+)@(.+)$',
+			'pattern' => '^acct:(.+)@(.+)$',
 		);
 
 		return $params;

phpunit.xml.dist

@@ -7,7 +7,7 @@
 	convertWarningsToExceptions="true"
 	>
 	<testsuites>
-		<testsuite>
+		<testsuite name="ActivityPub">
 			<directory prefix="test-" suffix=".php">./tests/</directory>
 		</testsuite>
 	</testsuites>

readme.txt

@@ -1,10 +1,10 @@
 === ActivityPub ===
-Contributors: pfefferle, mediaformat
+Contributors: pfefferle, mediaformat, akirk
 Donate link: https://notiz.blog/donate/
 Tags: OStatus, fediverse, activitypub, activitystream
 Requires at least: 4.7
-Tested up to: 5.9
+Tested up to: 6.1
-Stable tag: 0.13.3
+Stable tag: 0.16.2
 Requires PHP: 5.6
 License: MIT
 License URI: http://opensource.org/licenses/MIT
@@ -88,6 +88,53 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [pfefferle/wordpress-activitypub](https://github.com/pfefferle/wordpress-activitypub).
 
+= 0.16.2 =
+
+* Fix fatal error in outbox
+
+= 0.16.1 =
+
+* Fix "update and create, posts appear blank on Mastodon" issue
+
+= 0.16.0 =
+
+* Add "Outgoing Mentions" ([#213](https://github.com/pfefferle/wordpress-activitypub/pull/213)) props [@akirk](https://github.com/akirk)
+* Add configuration item for number of images to attach ([#248](https://github.com/pfefferle/wordpress-activitypub/pull/248)) props [@mexon](https://github.com/mexon)
+* Use shortcodes instead of custom templates, to setup the Activity Post-Content ([#250](https://github.com/pfefferle/wordpress-activitypub/pull/250)) props [@toolstack](https://github.com/toolstack)
+* Remove custom REST Server, because the needed changes are now merged into Core.
+* Fix hashtags ([#261](https://github.com/pfefferle/wordpress-activitypub/pull/261)) props [@akirk](https://github.com/akirk)
+* Change priorites, to maybe fix the hashtag issue
+
+= 0.15.0 =
+
+* Enable ActivityPub only for users that can `publish_posts`
+* Persist only public Activities
+* Fix remote-delete
+
+= 0.14.3 =
+
+* Better error handling. props [@akirk](https://github.com/akirk)
+
+= 0.14.2 =
+
+* Fix Critical error when using Friends Plugin and adding new URL to follow. props [@akirk](https://github.com/akirk)
+
+= 0.14.1 =
+
+* Fix "WebFinger not compatible with PHP < 8.0". props [@mexon](https://github.com/mexon)
+
+= 0.14.0 =
+
+* Friends support: https://wordpress.org/plugins/friends/ props [@akirk](https://github.com/akirk)
+* Massive guidance improvements. props [mediaformat](https://github.com/mediaformat) & [@akirk](https://github.com/akirk)
+* Add Custom Post Type support to outbox API. props [blueset](https://github.com/blueset)
+* Better hash-tag support. props [bocops](https://github.com/bocops)
+* Fix user-count (NodeInfo). props [mediaformat](https://github.com/mediaformat)
+
+= 0.13.4 =
+
+* fix webfinger for email identifiers
+
 = 0.13.3 =
 
 * fix: Create and Note should not have the same ActivityPub ID

templates/admin-header.php

@@ -0,0 +1,16 @@
+<div class="activitypub-settings-header">
+	<div class="activitypub-settings-title-section">
+		<h1><?php \esc_html_e( 'ActivityPub', 'activitypub' ); ?></h1>
+	</div>
+
+	<nav class="activitypub-settings-tabs-wrapper hide-if-no-js" aria-label="<?php \esc_attr_e( 'Secondary menu', 'activitypub' ); ?>">
+		<a href="<?php echo \esc_url_raw( admin_url( 'options-general.php?page=activitypub' ) ); ?>" class="activitypub-settings-tab <?php echo \esc_attr( $args['welcome'] ); ?>">
+			<?php \esc_html_e( 'Welcome', 'activitypub' ); ?>
+		</a>
+
+		<a href="<?php echo \esc_url_raw( admin_url( 'options-general.php?page=activitypub&tab=settings' ) ); ?>" class="activitypub-settings-tab <?php echo \esc_attr( $args['settings'] ); ?>">
+			<?php \esc_html_e( 'Settings', 'activitypub' ); ?>
+		</a>
+	</nav>
+</div>
+<hr class="wp-header-end">

templates/author-json.php

@@ -75,12 +75,6 @@ if ( \get_the_author_meta( 'user_url', $author_id ) ) {
 	);
 }
 
-/*
-$json->endpoints = array(
-	'sharedInbox' => \get_rest_url( null, '/activitypub/1.0/inbox' ),
-);
-*/
-
 // filter output
 $json = \apply_filters( 'activitypub_json_author_array', $json, $author_id );
 

templates/blog-json.php

@@ -27,10 +27,10 @@ if ( \has_header_image() ) {
 	);
 }
 
-$json->inbox = \get_rest_url( null, "/activitypub/1.0/blog/inbox" );
+$json->inbox = \get_rest_url( null, '/activitypub/1.0/blog/inbox' );
-$json->outbox = \get_rest_url( null, "/activitypub/1.0/blog/outbox" );
+$json->outbox = \get_rest_url( null, '/activitypub/1.0/blog/outbox' );
-$json->followers = \get_rest_url( null, "/activitypub/1.0/blog/followers" );
+$json->followers = \get_rest_url( null, '/activitypub/1.0/blog/followers' );
-$json->following = \get_rest_url( null, "/activitypub/1.0/blog/following" );
+$json->following = \get_rest_url( null, '/activitypub/1.0/blog/following' );
 
 $json->manuallyApprovesFollowers = \apply_filters( 'activitypub_json_manually_approves_followers', \__return_false() ); // phpcs:ignore
 
@@ -38,7 +38,7 @@ $json->manuallyApprovesFollowers = \apply_filters( 'activitypub_json_manually_ap
 $json->publicKey = array(
 	'id' => \get_home_url( '/' ) . '#main-key',
 	'owner' => \get_home_url( '/' ),
-	'publicKeyPem' => \trim(),
+	'publicKeyPem' => '',
 );
 
 $json->tag = array();
@@ -54,12 +54,6 @@ $json->attachment[] = array(
 	),
 );
 
-/*
-$json->endpoints = array(
-	'sharedInbox' => \get_rest_url( null, '/activitypub/1.0/inbox' ),
-);
-*/
-
 // filter output
 $json = \apply_filters( 'activitypub_json_blog_array', $json );
 

templates/followers-list.php

@@ -1,7 +1,8 @@
 <div class="wrap">
 	<h1><?php \esc_html_e( 'Followers (Fediverse)', 'activitypub' ); ?></h1>
 
-	<p><?php \printf( \__( 'You currently have %s followers.', 'activitypub' ), \esc_attr( \Activitypub\Peer\Followers::count_followers( \get_current_user_id() ) ) ); ?></p>
+	<?php // translators: ?>
+	<p><?php \printf( \esc_html__( 'You currently have %s followers.', 'activitypub' ), \esc_attr( \Activitypub\Peer\Followers::count_followers( \get_current_user_id() ) ) ); ?></p>
 
 	<?php $token_table = new \Activitypub\Table\Followers_List(); ?>
 

templates/post-json.php

@@ -1,4 +1,5 @@
 <?php
+// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
 $post = \get_post();
 
 $activitypub_post = new \Activitypub\Model\Post( $post );

templates/settings.php

@@ -1,12 +1,36 @@
-<div class="wrap">
+<?php
-	<h1><?php \esc_html_e( 'ActivityPub Settings', 'activitypub' ); ?></h1>
+\load_template(
+	\dirname( __FILE__ ) . '/admin-header.php',
+	true,
+	array(
+		'settings' => 'active',
+		'welcome' => '',
+	)
+);
+?>
 
-	<p><?php \esc_html_e( 'ActivityPub turns your blog into a federated social network. This means you can share and talk to everyone using the ActivityPub protocol, including users of Friendica, Pleroma and Mastodon.', 'activitypub' ); ?></p>
+<div class="privacy-settings-body hide-if-no-js">
+	<div class="notice notice-info">
+		<p>
+			<?php
+			echo \wp_kses(
+				\sprintf(
+					// translators:
+					\__( 'If you have problems using this plugin, please check the <a href="%s">Site Health</a> to ensure that your site is compatible and/or use the "Help" tab (in the top right of the settings pages).', 'activitypub' ),
+					\esc_url_raw( \admin_url( 'site-health.php' ) )
+				),
+				'default'
+			);
+			?>
+		</p>
+	</div>
+
+	<p><?php \esc_html_e( 'Customize your ActivityPub settings to suit your needs.', 'activitypub' ); ?></p>
 
 	<form method="post" action="options.php">
 		<?php \settings_fields( 'activitypub' ); ?>
 
-		<h2><?php \esc_html_e( 'Activities', 'activitypub' ); ?></h2>
+		<h3><?php \esc_html_e( 'Activities', 'activitypub' ); ?></h3>
 
 		<p><?php \esc_html_e( 'All activity related settings.', 'activitypub' ); ?></p>
 
@@ -30,18 +54,43 @@
 							<label><input type="radio" name="activitypub_post_content_type" id="activitypub_post_content_type_custom" value="custom" <?php echo \checked( 'custom', \get_option( 'activitypub_post_content_type', 'content' ) ); ?> /> <?php \esc_html_e( 'Custom', 'activitypub' ); ?></label> - <span class="description"><?php \esc_html_e( 'Use the text-area below, to customize your activities.', 'activitypub' ); ?></span>
 						</p>
 						<p>
-							<textarea name="activitypub_custom_post_content" id="activitypub_custom_post_content" rows="10" cols="50" class="large-text" placeholder="<?php echo ACTIVITYPUB_CUSTOM_POST_CONTENT; ?>"><?php echo \get_option( 'activitypub_custom_post_content', ACTIVITYPUB_CUSTOM_POST_CONTENT ); ?></textarea>
+							<textarea name="activitypub_custom_post_content" id="activitypub_custom_post_content" rows="10" cols="50" class="large-text" placeholder="<?php echo wp_kses( ACTIVITYPUB_CUSTOM_POST_CONTENT, 'post' ); ?>"><?php echo wp_kses( \get_option( 'activitypub_custom_post_content', ACTIVITYPUB_CUSTOM_POST_CONTENT ), 'post' ); ?></textarea>
-							<div class="description">
+							<details>
-								<ul>
+								<summary><?php esc_html_e( 'See a list of ActivityPub Template Tags.', 'activitypub' ); ?></summary>
-									<li><code>%title%</code> - <?php \esc_html_e( 'The Post-Title.', 'activitypub' ); ?></li>
+								<div class="description">
-									<li><code>%content%</code> - <?php \esc_html_e( 'The Post-Content.', 'activitypub' ); ?></li>
+									<ul>
-									<li><code>%excerpt%</code> - <?php \esc_html_e( 'The Post-Excerpt (default 400 Chars).', 'activitypub' ); ?></li>
+										<li><code>[ap_title]</code> - <?php \esc_html_e( 'The post\'s title.', 'activitypub' ); ?></li>
-									<li><code>%permalink%</code> - <?php \esc_html_e( 'The Post-Permalink.', 'activitypub' ); ?></li>
+										<li><code>[ap_content]</code> - <?php \esc_html_e( 'The post\'s content.', 'activitypub' ); ?></li>
-									<li><code>%shortlink%</code> - <?php \printf( \esc_html( 'The Post-Shortlink. I can recommend %sHum%s, to prettify the Shortlinks', 'activitypub' ), '<a href="https://wordpress.org/plugins/hum/" target="_blank">', '</a>' ); ?></li>
+										<li><code>[ap_excerpt]</code> - <?php \esc_html_e( 'The post\'s excerpt (default 400 chars).', 'activitypub' ); ?></li>
-									<li><code>%hashtags%</code> - <?php \esc_html_e( 'The Tags as Hashtags.', 'activitypub' ); ?></li>
+										<li><code>[ap_permalink]</code> - <?php \esc_html_e( 'The post\'s permalink.', 'activitypub' ); ?></li>
-								</ul>
+										<li><code>[ap_shortlink]</code> - <?php echo \wp_kses( \__( 'The post\'s shortlink. I can recommend <a href="https://wordpress.org/plugins/hum/" target="_blank">Hum</a>.', 'activitypub' ), 'default' ); ?></li>
-								<?php \printf( \__( '%sLet me know%s if you miss a template placeholder.', 'activitypub' ), '<a href="https://github.com/pfefferle/wordpress-activitypub/issues/new" target="_blank">', '</a>' ); ?>
+										<li><code>[ap_hashtags]</code> - <?php \esc_html_e( 'The post\'s tags as hashtags.', 'activitypub' ); ?></li>
-							</div>
+										<li><code>[ap_hashcats]</code> - <?php \esc_html_e( 'The post\'s categories as hashtags.', 'activitypub' ); ?></li>
+										<li><code>[ap_image]</code> - <?php \esc_html_e( 'The URL for the post\'s featured image.', 'activitypub' ); ?></li>
+									</ul>
+									<p><?php \esc_html_e( 'You can find the full list with all possible attributes in the help section on the top-right of the screen.', 'activitypub' ); ?></p>
+								</div>
+							</details>
+						</p>
+					</td>
+				</tr>
+				<tr>
+					<th scope="row">
+						<?php \esc_html_e( 'Number of images', 'activitypub' ); ?>
+					</th>
+					<td>
+						<input value="<?php echo esc_attr( \get_option( 'activitypub_max_image_attachments', ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS ) ); ?>" name="activitypub_max_image_attachments" id="activitypub_max_image_attachments" type="number" min="0" />
+						<p class="description">
+							<?php
+							echo \wp_kses(
+								\sprintf(
+									// translators:
+									\__( 'The number of images to attach to posts. Default: <code>%s</code>', 'activitypub' ),
+									\esc_html( ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS )
+								),
+								'default'
+							);
+							?>
 						</p>
 					</td>
 				</tr>
@@ -70,6 +119,7 @@
 							<?php $post_types = \get_post_types( array( 'public' => true ), 'objects' ); ?>
 							<?php $support_post_types = \get_option( 'activitypub_support_post_types', array( 'post', 'page' ) ) ? \get_option( 'activitypub_support_post_types', array( 'post', 'page' ) ) : array(); ?>
 							<ul>
+							<?php // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited ?>
 							<?php foreach ( $post_types as $post_type ) { ?>
 								<li>
 									<input type="checkbox" id="activitypub_support_post_types" name="activitypub_support_post_types[]" value="<?php echo \esc_attr( $post_type->name ); ?>" <?php echo \checked( true, \in_array( $post_type->name, $support_post_types, true ) ); ?> />
@@ -82,29 +132,20 @@
 				</tr>
 				<tr>
 					<th scope="row">
-						<?php \esc_html_e( 'Hashtags', 'activitypub' ); ?>
+						<?php \esc_html_e( 'Hashtags (beta)', 'activitypub' ); ?>
 					</th>
 					<td>
 						<p>
-							<label><input type="checkbox" name="activitypub_use_hashtags" id="activitypub_use_hashtags" value="1" <?php echo \checked( '1', \get_option( 'activitypub_use_hashtags', '1' ) ); ?> /> <?php \_e( 'Add hashtags in the content as native tags and replace the <code>#tag</code> with the tag-link.', 'activitypub' ); ?></label>
+							<label><input type="checkbox" name="activitypub_use_hashtags" id="activitypub_use_hashtags" value="1" <?php echo \checked( '1', \get_option( 'activitypub_use_hashtags', '1' ) ); ?> /> <?php echo wp_kses( \__( 'Add hashtags in the content as native tags and replace the <code>#tag</code> with the tag-link. <strong>This feature is experimental! Please disable it, if you find any HTML or CSS errors.</strong>', 'activitypub' ), 'default' ); ?></label>
 						</p>
 					</td>
 				</tr>
-				<tr>
-					<th scope="row">
-						<?php \esc_html_e( 'HTML Whitelist', 'activitypub' ); ?>
-					</th>
-					<td>
-						<textarea name="activitypub_allowed_html" id="activitypub_allowed_html" rows="3" cols="50" class="large-text"><?php echo \get_option( 'activitypub_allowed_html', ACTIVITYPUB_ALLOWED_HTML ); ?></textarea>
-						<p class="description"><?php \_e( \sprintf( 'A list of HTML elements, you want to whitelist for your activities. <strong>Leave list empty to support all HTML elements.</strong> Default: <code>%s</code>.', \esc_html( ACTIVITYPUB_ALLOWED_HTML ) ), 'activitypub' ); ?></p>
-					</td>
-				</tr>
 			</tbody>
 		</table>
 
 		<?php \do_settings_fields( 'activitypub', 'activity' ); ?>
 
-		<h2><?php \esc_html_e( 'Server', 'activitypub' ); ?></h2>
+		<h3><?php \esc_html_e( 'Server', 'activitypub' ); ?></h3>
 
 		<p><?php \esc_html_e( 'Server related settings.', 'activitypub' ); ?></p>
 
@@ -115,7 +156,18 @@
 						<?php \esc_html_e( 'Blocklist', 'activitypub' ); ?>
 					</th>
 					<td>
-						<p class="description"><?php \printf( \__( 'To block servers, add the host of the server to the "<a href="%s">Disallowed Comment Keys</a>" list.', 'activitypub' ), admin_url( 'options-discussion.php#disallowed_keys' ) ); ?></p>
+						<p class="description">
+							<?php
+							echo \wp_kses(
+								\sprintf(
+									// translators: %s is a URL.
+									\__( 'To block servers, add the host of the server to the "<a href="%s">Disallowed Comment Keys</a>" list.', 'activitypub' ),
+									\esc_attr( \admin_url( 'options-discussion.php#disallowed_keys' ) )
+								),
+								'default'
+							);
+							?>
+						</p>
 					</td>
 				</tr>
 			</tbody>
@@ -127,8 +179,4 @@
 
 		<?php \submit_button(); ?>
 	</form>
-
-	<p>
-		<small><?php \_e( 'If you like this plugin, what about a small <a href="https://notiz.blog/donate">donation</a>?', 'activitypub' ); ?></small>
-	</p>
 </div>

templates/welcome.php

@@ -0,0 +1,96 @@
+<?php
+\load_template(
+	\dirname( __FILE__ ) . '/admin-header.php',
+	true,
+	array(
+		'settings' => '',
+		'welcome' => 'active',
+	)
+);
+?>
+
+<div class="privacy-settings-body hide-if-no-js">
+	<h2><?php \esc_html_e( 'Welcome', 'activitypub' ); ?></h2>
+
+	<p><?php \esc_html_e( 'With ActivityPub your blog becomes part of a federated social network. This means you can share and talk to everyone using the ActivityPub protocol, including users of Friendica, Pleroma and Mastodon.', 'activitypub' ); ?></p>
+	<p>
+		<?php
+		echo wp_kses(
+			\sprintf(
+				// translators:
+				\__(
+					'People can follow you by using the username <code>%1$s</code> or the URL <code>%2$s</code>. Users who can not access this settings page will find their username on the <a href="%3$s">Edit Profile</a> page.',
+					'activitypub'
+				),
+				\esc_attr( \Activitypub\get_webfinger_resource( wp_get_current_user()->ID ) ),
+				\esc_url_raw( \get_author_posts_url( wp_get_current_user()->ID ) ),
+				\esc_url_raw( \admin_url( 'profile.php#activitypub' ) )
+			),
+			'default'
+		);
+		?>
+	</p>
+	<p>
+		<?php
+		echo wp_kses(
+			\sprintf(
+				// translators:
+				\__( 'If you have problems using this plugin, please check the <a href="%s">Site Health</a> to ensure that your site is compatible and/or use the "Help" tab (in the top right of the settings pages).', 'activitypub' ),
+				\esc_url_raw( admin_url( 'site-health.php' ) )
+			),
+			'default'
+		);
+		?>
+	</p>
+
+	<hr />
+
+	<h3><?php \esc_html_e( 'Recommended Plugins', 'activitypub' ); ?></h3>
+
+	<p><?php \esc_html_e( 'ActivityPub works as is and there is no need for you to install additional plugins, nevertheless there are some plugins that extends the functionality of ActivityPub.', 'activitypub' ); ?></p>
+
+	<div class="activitypub-settings-accordion">
+		<h4 class="activitypub-settings-accordion-heading">
+			<button aria-expanded="true" class="activitypub-settings-accordion-trigger" aria-controls="activitypub-settings-accordion-block-friends-plugin" type="button">
+				<span class="title"><?php \esc_html_e( 'Following Others', 'activitypub' ); ?></span>
+				<span class="icon"></span>
+			</button>
+		</h4>
+		<div id="activitypub-settings-accordion-block-friends-plugin" class="activitypub-settings-accordion-panel plugin-card-friends">
+			<p><?php \esc_html_e( 'To follow people on Mastodon or similar platforms using your own WordPress, you can use the Friends Plugin for WordPress which uses this plugin to receive posts and display them on your own WordPress, thus making your own WordPress a Fediverse instance of its own.', 'activitypub' ); ?></p>
+			<p><a href="<?php echo \esc_url_raw( \admin_url( 'plugin-install.php?tab=plugin-information&plugin=friends&TB_iframe=true' ) ); ?>" class="thickbox open-plugin-details-modal button install-now" target="_blank"><?php \esc_html_e( 'Install the Friends Plugin for WordPress', 'activitypub' ); ?></a></p>
+		</div>
+		<h4 class="activitypub-settings-accordion-heading">
+			<button aria-expanded="false" class="activitypub-settings-accordion-trigger" aria-controls="activitypub-settings-accordion-block-activitypub-hum-plugin" type="button">
+				<span class="title"><?php \esc_html_e( 'Add a URL Shortener', 'activitypub' ); ?></span>
+				<span class="icon"></span>
+			</button>
+		</h4>
+		<div id="activitypub-settings-accordion-block-activitypub-hum-plugin" class="activitypub-settings-accordion-panel plugin-card-hum" hidden="hidden">
+			<p><?php \esc_html_e( 'Hum is a personal URL shortener for WordPress, designed to provide short URLs to your personal content, both hosted on WordPress and elsewhere.', 'activitypub' ); ?></p>
+			<p><a href="<?php echo \esc_url_raw( \admin_url( 'plugin-install.php?tab=plugin-information&plugin=hum&TB_iframe=true' ) ); ?>" class="thickbox open-plugin-details-modal button install-now" target="_blank"><?php \esc_html_e( 'Install Hum Plugin for WordPress', 'activitypub' ); ?></a></p>
+		</div>
+		<h4 class="activitypub-settings-accordion-heading">
+			<button aria-expanded="false" class="activitypub-settings-accordion-trigger" aria-controls="activitypub-settings-accordion-block-activitypub-webfinger-plugin" type="button">
+				<span class="title"><?php \esc_html_e( 'Advanced WebFinger Support', 'activitypub' ); ?></span>
+				<span class="icon"></span>
+			</button>
+		</h4>
+		<div id="activitypub-settings-accordion-block-activitypub-webfinger-plugin" class="activitypub-settings-accordion-panel plugin-card-webfinger" hidden="hidden">
+			<p><?php \esc_html_e( 'WebFinger is a protocol that allows for discovery of information about people and things identified by a URI. Information about a person might be discovered via an "acct:" URI, for example, which is a URI that looks like an email address.', 'activitypub' ); ?></p>
+			<p><?php \esc_html_e( 'The ActivityPub plugin comes with basic WebFinger support, if you need more configuration options and compatibility with other Fediverse/IndieWeb plugins, please install the WebFinger plugin.', 'activitypub' ); ?></p>
+			<p><a href="<?php echo \esc_url_raw( \admin_url( 'plugin-install.php?tab=plugin-information&plugin=webfinger&TB_iframe=true' ) ); ?>" class="thickbox open-plugin-details-modal button install-now" target="_blank"><?php \esc_html_e( 'Install WebFinger Plugin for WordPress', 'activitypub' ); ?></a></p>
+		</div>
+		<h4 class="activitypub-settings-accordion-heading">
+			<button aria-expanded="false" class="activitypub-settings-accordion-trigger" aria-controls="activitypub-settings-accordion-block-activitypub-nodeinfo-plugin" type="button">
+				<span class="title"><?php \esc_html_e( 'Provide Enhanced Information about Your Blog', 'activitypub' ); ?></span>
+				<span class="icon"></span>
+			</button>
+		</h4>
+		<div id="activitypub-settings-accordion-block-activitypub-nodeinfo-plugin" class="activitypub-settings-accordion-panel plugin-card-nodeinfo" hidden="hidden">
+			<p><?php \esc_html_e( 'NodeInfo is an effort to create a standardized way of exposing metadata about a server running one of the distributed social networks. The two key goals are being able to get better insights into the user base of distributed social networking and the ability to build tools that allow users to choose the best fitting software and server for their needs.', 'activitypub' ); ?></p>
+			<p><?php \esc_html_e( 'The ActivityPub plugin comes with a simple NodeInfo endpoint. If you need more configuration options and compatibility with other Fediverse plugins, please install the NodeInfo plugin.', 'activitypub' ); ?></p>
+			<p><a href="<?php echo \esc_url_raw( \admin_url( 'plugin-install.php?tab=plugin-information&plugin=nodeinfo&TB_iframe=true' ) ); ?>" class="thickbox open-plugin-details-modal button install-now" target="_blank"><?php \esc_html_e( 'Install NodeInfo Plugin for WordPress', 'activitypub' ); ?></a></p>
+		</div>
+	</div>
+</div>

tests/bootstrap.php

@@ -24,3 +24,4 @@ function _manually_load_plugin() {
 
 // Start up the WP testing environment.
 require $_tests_dir . '/includes/bootstrap.php';
+require __DIR__ . '/class-activitypub-testcase-cache-http.php';

tests/class-activitypub-testcase-cache-http.php

@@ -0,0 +1,105 @@
+<?php
+class ActivityPub_TestCase_Cache_HTTP extends \WP_UnitTestCase {
+	public $server;
+	public function set_up() {
+		parent::set_up();
+
+		// Manually activate the REST server.
+		global $wp_rest_server;
+		$wp_rest_server = new \Spy_REST_Server();
+		$this->server   = $wp_rest_server;
+		do_action( 'rest_api_init' );
+
+		add_filter(
+			'rest_url',
+			function() {
+				return get_option( 'home' ) . '/wp-json/';
+			}
+		);
+
+		add_filter( 'pre_http_request', array( get_called_class(), 'pre_http_request' ), 10, 3 );
+		add_filter( 'http_response', array( get_called_class(), 'http_response' ), 10, 3 );
+	}
+
+	public function tear_down() {
+		remove_filter( 'pre_http_request', array( get_called_class(), 'pre_http_request' ) );
+		remove_filter( 'http_response', array( get_called_class(), 'http_response' ) );
+		parent::tear_down();
+	}
+
+
+	public static function pre_http_request( $preempt, $request, $url ) {
+		$p = wp_parse_url( $url );
+		$cache = __DIR__ . '/fixtures/' . sanitize_title( $p['host'] . '-' . $p['path'] ) . '.json';
+		if ( file_exists( $cache ) ) {
+			return apply_filters(
+				'fake_http_response',
+				json_decode( file_get_contents( $cache ), true ), // phpcs:ignore
+				$p['scheme'] . '://' . $p['host'],
+				$url,
+				$request
+			);
+		}
+
+		$home_url = home_url();
+
+		// Pretend the url now is the requested one.
+		update_option( 'home', $p['scheme'] . '://' . $p['host'] );
+		$rest_prefix = home_url() . '/wp-json';
+
+		if ( false === strpos( $url, $rest_prefix ) ) {
+			// Restore the old home_url.
+			update_option( 'home', $home_url );
+			return $preempt;
+		}
+
+		$url = substr( $url, strlen( $rest_prefix ) );
+		$r   = new \WP_REST_Request( $request['method'], $url );
+		if ( ! empty( $request['body'] ) ) {
+			foreach ( $request['body'] as $key => $value ) {
+				$r->set_param( $key, $value );
+			}
+		}
+		global $wp_rest_server;
+		$response = $wp_rest_server->dispatch( $r );
+		// Restore the old url.
+		update_option( 'home', $home_url );
+
+		return apply_filters(
+			'fake_http_response',
+			array(
+				'headers'  => array(
+					'content-type' => 'text/json',
+				),
+				'body'     => wp_json_encode( $response->data ),
+				'response' => array(
+					'code' => $response->status,
+				),
+			),
+			$p['scheme'] . '://' . $p['host'],
+			$url,
+			$request
+		);
+	}
+
+	public static function http_response( $response, $args, $url ) {
+		$p = wp_parse_url( $url );
+		$cache = __DIR__ . '/fixtures/' . sanitize_title( $p['host'] . '-' . $p['path'] ) . '.json';
+		if ( ! file_exists( $cache ) ) {
+			$headers = wp_remote_retrieve_headers( $response );
+			file_put_contents( // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents
+				$cache,
+				wp_json_encode(
+					array(
+						'headers'  => $headers->getAll(),
+						'body'     => wp_remote_retrieve_body( $response ),
+						'response' => array(
+							'code' => wp_remote_retrieve_response_code( $response ),
+						),
+					)
+				)
+			);
+		}
+		return $response;
+	}
+}

tests/fixtures/notiz-blog-author-matthias-pfefferle.json

@@ -0,0 +1,22 @@
+{
+    "headers": {
+        "date": "Fri, 09 Dec 2022 10:39:51 GMT",
+        "content-type": "application\/activity+json",
+        "server": "nginx",
+        "x-xrds-location": "https:\/\/notiz.blog\/?xrds",
+        "x-yadis-location": "https:\/\/notiz.blog\/?xrds",
+        "link": "<https:\/\/notiz.blog\/wp-api\/micropub\/1.0\/media>; rel=\"micropub_media\", <https:\/\/notiz.blog\/wp-api\/micropub\/1.0\/endpoint>; rel=\"micropub\", <https:\/\/notiz.blog\/wp-api\/friends\/v1>; rel=\"friends-base-url\", <https:\/\/notiz.blog\/wp-api\/indieauth\/1.0\/auth>; rel=\"authorization_endpoint\", <https:\/\/notiz.blog\/wp-api\/indieauth\/1.0\/token>; rel=\"token_endpoint\", <https:\/\/notiz.blog\/wp-api\/indieauth\/1.0\/metadata>; rel=\"indieauth-metadata\", <https:\/\/notiz.blog\/wp-api\/>; rel=\"https:\/\/api.w.org\/\", <https:\/\/notiz.blog\/wp-api\/wp\/v2\/users\/1>; rel=\"alternate\"; type=\"application\/json\"",
+        "cache-control": "max-age=0, public",
+        "expires": "Fri, 09 Dec 2022 10:39:51 GMT",
+        "x-xss-protection": "1; mode=block",
+        "x-content-type-options": "nosniff",
+        "strict-transport-security": "max-age=31536000",
+        "x-frame-options": "SAMEORIGIN",
+        "referrer-policy": "strict-origin-when-cross-origin",
+        "x-clacks-overhead": "GNU Terry Pratchett"
+    },
+    "body": "{\"@context\":[\"https:\\\/\\\/www.w3.org\\\/ns\\\/activitystreams\",\"https:\\\/\\\/w3id.org\\\/security\\\/v1\",{\"manuallyApprovesFollowers\":\"as:manuallyApprovesFollowers\",\"PropertyValue\":\"schema:PropertyValue\",\"schema\":\"http:\\\/\\\/schema.org#\",\"pt\":\"https:\\\/\\\/joinpeertube.org\\\/ns#\",\"toot\":\"http:\\\/\\\/joinmastodon.org\\\/ns#\",\"value\":\"schema:value\",\"Hashtag\":\"as:Hashtag\",\"featured\":{\"@id\":\"toot:featured\",\"@type\":\"@id\"},\"featuredTags\":{\"@id\":\"toot:featuredTags\",\"@type\":\"@id\"}}],\"id\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\",\"type\":\"Person\",\"name\":\"Matthias Pfefferle\",\"summary\":\"Ich bin Webworker und arbeite als \\u0022Head of WordPress Development\\u0022 f\\u00fcr IONOS in Karlsruhe. Ich blogge, podcaste und schreibe \\u003Cdel\\u003Eeine Kolumne\\u003C\\\/del\\u003E \\u00fcber das open, independent und federated social Web. \\u003Ca href=\\u0022https:\\\/\\\/notiz.blog\\\/about\\\/\\u0022\\u003EMehr \\u00fcber mich.\\u003C\\\/a\\u003E\",\"preferredUsername\":\"pfefferle\",\"url\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\",\"icon\":{\"type\":\"Image\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75512bb584bbceae57dfc503692b16b2?s=120\\u0026d=mm\\u0026r=g\"},\"image\":{\"type\":\"Image\",\"url\":\"https:\\\/\\\/notiz.blog\\\/wp-content\\\/uploads\\\/2017\\\/02\\\/cropped-Unknown-2.jpeg\"},\"inbox\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/activitypub\\\/1.0\\\/users\\\/1\\\/inbox\",\"outbox\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/activitypub\\\/1.0\\\/users\\\/1\\\/outbox\",\"followers\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/activitypub\\\/1.0\\\/users\\\/1\\\/followers\",\"following\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/activitypub\\\/1.0\\\/users\\\/1\\\/following\",\"manuallyApprovesFollowers\":false,\"publicKey\":{\"id\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/#main-key\",\"owner\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\",\"publicKeyPem\":\"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA039CnlArzn6nsRjcC2RJ\\nrjY3K5ZrLnFUbPtHLGNXMJUGW+rFYE1DzhdKPTj9giiXE+J7ADI0Tme5rSWw14bT\\nLhOMBs2ma8d03\\\/wnF1+kxDBeRyvyoki2TjtiJdoPu1jwZLLYTuzWTXdDiqrwSKOL\\nncKFGIkjyzOLoYuIKPgIuFg3Mt8rI6teQ2Q65YsGvOG\\\/mjBOUwl5FjgcGt9aQARd\\nmFxW5XydxfNrCZwuE34Zbq\\\/IC7rvaUx98zvrEHrD237YQ8O4M3afC9Kbu5Xp7k8Q\\n5JG80RItV7n8xjyt0i9LaVwlZDDYmLDYv50VhjcwRvtVFVfaN7yxDnHttd1NNENK\\nCwIDAQAB\\n-----END PUBLIC KEY-----\"},\"tag\":[],\"attachment\":[{\"type\":\"PropertyValue\",\"name\":\"Blog\",\"value\":\"\\u003Ca rel=\\u0022me\\u0022 title=\\u0022https:\\\/\\\/notiz.blog\\\/\\u0022 target=\\u0022_blank\\u0022 href=\\u0022https:\\\/\\\/notiz.blog\\\/\\u0022\\u003Enotiz.blog\\u003C\\\/a\\u003E\"},{\"type\":\"PropertyValue\",\"name\":\"Profil\",\"value\":\"\\u003Ca rel=\\u0022me\\u0022 title=\\u0022https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\\u0022 target=\\u0022_blank\\u0022 href=\\u0022https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\\u0022\\u003Enotiz.blog\\u003C\\\/a\\u003E\"},{\"type\":\"PropertyValue\",\"name\":\"Website\",\"value\":\"\\u003Ca rel=\\u0022me\\u0022 title=\\u0022https:\\\/\\\/pfefferle.org\\\/\\u0022 target=\\u0022_blank\\u0022 href=\\u0022https:\\\/\\\/pfefferle.org\\\/\\u0022\\u003Epfefferle.org\\u003C\\\/a\\u003E\"}]}",
+    "response": {
+        "code": 200
+    }
+}

tests/fixtures/notiz-blog-well-known-webfinger.json

@@ -0,0 +1,22 @@
+{
+    "headers": {
+        "date": "Fri, 09 Dec 2022 10:39:51 GMT",
+        "content-type": "application\/jrd+json; charset=UTF-8",
+        "server": "nginx",
+        "x-xrds-location": "https:\/\/notiz.blog\/?xrds",
+        "x-yadis-location": "https:\/\/notiz.blog\/?xrds",
+        "access-control-allow-origin": "*",
+        "cache-control": "max-age=2592000, public",
+        "expires": "Sun, 08 Jan 2023 10:39:50 GMT",
+        "x-xss-protection": "1; mode=block",
+        "x-content-type-options": "nosniff",
+        "strict-transport-security": "max-age=31536000",
+        "x-frame-options": "SAMEORIGIN",
+        "referrer-policy": "strict-origin-when-cross-origin",
+        "x-clacks-overhead": "GNU Terry Pratchett"
+    },
+    "body": "{\"subject\":\"acct:pfefferle@notiz.blog\",\"aliases\":[\"acct:pfefferle@notiz.blog\",\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\",\"mailto:pfefferle@notiz.blog\"],\"links\":[{\"rel\":\"http:\\\/\\\/webfinger.net\\\/rel\\\/profile-page\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\",\"type\":\"text\\\/html\"},{\"rel\":\"http:\\\/\\\/webfinger.net\\\/rel\\\/avatar\",\"href\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75512bb584bbceae57dfc503692b16b2?s=96&d=mm&r=g\"},{\"rel\":\"http:\\\/\\\/webfinger.net\\\/rel\\\/profile-page\",\"href\":\"https:\\\/\\\/pfefferle.org\\\/\",\"type\":\"text\\\/html\"},{\"rel\":\"payment\",\"href\":\"https:\\\/\\\/www.paypal.me\\\/matthiaspfefferle\"},{\"rel\":\"payment\",\"href\":\"https:\\\/\\\/liberapay.com\\\/pfefferle\\\/\"},{\"rel\":\"payment\",\"href\":\"https:\\\/\\\/notiz.blog\\\/donate\\\/\"},{\"rel\":\"payment\",\"href\":\"https:\\\/\\\/flattr.com\\\/@pfefferle\"},{\"href\":\"https:\\\/\\\/notiz.blog\\\/\",\"rel\":\"http:\\\/\\\/specs.openid.net\\\/auth\\\/2.0\\\/provider\"},{\"rel\":\"self\",\"type\":\"application\\\/activity+json\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/\"},{\"rel\":\"micropub_media\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/micropub\\\/1.0\\\/media\"},{\"rel\":\"micropub\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/micropub\\\/1.0\\\/endpoint\"},{\"rel\":\"http:\\\/\\\/nodeinfo.diaspora.software\\\/ns\\\/schema\\\/2.0\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/nodeinfo\\\/2.0\"},{\"rel\":\"http:\\\/\\\/nodeinfo.diaspora.software\\\/ns\\\/schema\\\/1.1\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/nodeinfo\\\/1.1\"},{\"rel\":\"http:\\\/\\\/nodeinfo.diaspora.software\\\/ns\\\/schema\\\/1.0\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/nodeinfo\\\/1.0\"},{\"rel\":\"https:\\\/\\\/feneas.org\\\/ns\\\/serviceinfo\",\"type\":\"application\\\/ld+json\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/serviceinfo\\\/1.0\",\"properties\":{\"https:\\\/\\\/feneas.org\\\/ns\\\/serviceinfo#software.name\":\"notizBlog\"}},{\"rel\":\"http:\\\/\\\/schemas.google.com\\\/g\\\/2010#updates-from\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/feed\\\/ostatus\\\/\",\"type\":\"application\\\/atom+xml\"},{\"rel\":\"http:\\\/\\\/ostatus.org\\\/schema\\\/1.0\\\/subscribe\",\"template\":\"https:\\\/\\\/notiz.blog\\\/?profile={uri}\"},{\"rel\":\"magic-public-key\",\"href\":\"data:application\\\/magic-public-key,RSA.039CnlArzn6nsRjcC2RJrjY3K5ZrLnFUbPtHLGNXMJUGW-rFYE1DzhdKPTj9giiXE-J7ADI0Tme5rSWw14bTLhOMBs2ma8d03_wnF1-kxDBeRyvyoki2TjtiJdoPu1jwZLLYTuzWTXdDiqrwSKOLncKFGIkjyzOLoYuIKPgIuFg3Mt8rI6teQ2Q65YsGvOG_mjBOUwl5FjgcGt9aQARdmFxW5XydxfNrCZwuE34Zbq_IC7rvaUx98zvrEHrD237YQ8O4M3afC9Kbu5Xp7k8Q5JG80RItV7n8xjyt0i9LaVwlZDDYmLDYv50VhjcwRvtVFVfaN7yxDnHttd1NNENKCw==.AQAB\"},{\"rel\":\"salmon\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/?salmon=endpoint\"},{\"rel\":\"http:\\\/\\\/salmon-protocol.org\\\/ns\\\/salmon-replies\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/?salmon=endpoint\"},{\"rel\":\"http:\\\/\\\/salmon-protocol.org\\\/ns\\\/salmon-mention\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/?salmon=endpoint\"},{\"rel\":\"feed\",\"type\":\"application\\\/stream+json\",\"title\":\"Activity-Streams 1.0 Feed\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/feed\\\/as1\\\/\"},{\"rel\":\"feed\",\"type\":\"application\\\/activity+json\",\"title\":\"Activity-Streams 2.0 Feed\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/feed\\\/as2\\\/\"},{\"rel\":\"http:\\\/\\\/oexchange.org\\\/spec\\\/0.8\\\/rel\\\/user-target\",\"href\":\"https:\\\/\\\/notiz.blog\\\/?oexchange=xrd\",\"type\":\"application\\\/xrd+xml\"},{\"rel\":\"http:\\\/\\\/a9.com\\\/-\\\/spec\\\/opensearch\\\/1.1\\\/\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/opensearch\\\/1.1\\\/document\",\"type\":\"application\\\/opensearchdescription+xml\"},{\"rel\":\"describedby\",\"href\":\"https:\\\/\\\/notiz.blog\\\/author\\\/matthias-pfefferle\\\/feed\\\/foaf\\\/\",\"type\":\"application\\\/rdf+xml\"},{\"rel\":\"webmention\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/webmention\\\/1.0\\\/endpoint\"},{\"rel\":\"http:\\\/\\\/webmention.org\\\/\",\"href\":\"https:\\\/\\\/notiz.blog\\\/wp-api\\\/webmention\\\/1.0\\\/endpoint\"}],\"properties\":{\"http:\\\/\\\/salmon-protocol.org\\\/ns\\\/magic-key\":\"RSA.039CnlArzn6nsRjcC2RJrjY3K5ZrLnFUbPtHLGNXMJUGW-rFYE1DzhdKPTj9giiXE-J7ADI0Tme5rSWw14bTLhOMBs2ma8d03_wnF1-kxDBeRyvyoki2TjtiJdoPu1jwZLLYTuzWTXdDiqrwSKOLncKFGIkjyzOLoYuIKPgIuFg3Mt8rI6teQ2Q65YsGvOG_mjBOUwl5FjgcGt9aQARdmFxW5XydxfNrCZwuE34Zbq_IC7rvaUx98zvrEHrD237YQ8O4M3afC9Kbu5Xp7k8Q5JG80RItV7n8xjyt0i9LaVwlZDDYmLDYv50VhjcwRvtVFVfaN7yxDnHttd1NNENKCw==.AQAB\"}}",
+    "response": {
+        "code": 200
+    }
+}

tests/test-class-activitypub-activity-dispatcher.php

@@ -0,0 +1,139 @@
+<?php
+class Test_Activitypub_Activity_Dispatcher extends ActivityPub_TestCase_Cache_HTTP {
+	public static $users = array(
+		'username@example.org' => array(
+			'url' => 'https://example.org/users/username',
+			'inbox' => 'https://example.org/users/username/inbox',
+			'name'  => 'username',
+		),
+		'jon@example.com' => array(
+			'url' => 'https://example.com/author/jon',
+			'inbox' => 'https://example.com/author/jon/inbox',
+			'name'  => 'jon',
+		),
+	);
+
+	public function test_dispatch_activity() {
+		$followers = array( 'https://example.com/author/jon', 'https://example.org/users/username' );
+		\update_user_meta( 1, 'activitypub_followers', $followers );
+
+		$post = \wp_insert_post(
+			array(
+				'post_author' => 1,
+				'post_content' => 'hello',
+			)
+		);
+
+		$pre_http_request = new MockAction();
+		add_filter( 'pre_http_request', array( $pre_http_request, 'filter' ), 10, 3 );
+
+		$activitypub_post = new \Activitypub\Model\Post( $post );
+		\Activitypub\Activity_Dispatcher::send_post_activity( $activitypub_post );
+
+		$this->assertNotEmpty( $activitypub_post->get_content() );
+
+		$this->assertSame( 2, $pre_http_request->get_call_count() );
+		$all_args = $pre_http_request->get_args();
+		$first_call_args = array_shift( $all_args );
+		$this->assertEquals( 'https://example.com/author/jon/inbox', $first_call_args[2] );
+
+		$second_call_args = array_shift( $all_args );
+		$this->assertEquals( 'https://example.org/users/username/inbox', $second_call_args[2] );
+
+		remove_filter( 'pre_http_request', array( $pre_http_request, 'filter' ), 10 );
+	}
+	public function test_dispatch_mentions() {
+		$post = \wp_insert_post(
+			array(
+				'post_author' => 1,
+				'post_content' => '@alex hello',
+			)
+		);
+
+		self::$users['https://example.com/alex'] = array(
+			'url' => 'https://example.com/alex',
+			'inbox' => 'https://example.com/alex/inbox',
+			'name'  => 'alex',
+		);
+
+		add_filter(
+			'activitypub_extract_mentions',
+			function( $mentions ) {
+				$mentions[] = 'https://example.com/alex';
+				return $mentions;
+			},
+			10
+		);
+
+		$pre_http_request = new MockAction();
+		add_filter( 'pre_http_request', array( $pre_http_request, 'filter' ), 10, 3 );
+
+		$activitypub_post = new \Activitypub\Model\Post( $post );
+		\Activitypub\Activity_Dispatcher::send_post_activity( $activitypub_post );
+
+		$this->assertNotEmpty( $activitypub_post->get_content() );
+
+		$this->assertSame( 1, $pre_http_request->get_call_count() );
+		$all_args = $pre_http_request->get_args();
+		$first_call_args = $all_args[0];
+		$this->assertEquals( 'https://example.com/alex/inbox', $first_call_args[2] );
+
+		$body = json_decode( $first_call_args[1]['body'], true );
+		$this->assertArrayHasKey( 'id', $body );
+
+		remove_all_filters( 'activitypub_from_post_object' );
+		remove_filter( 'pre_http_request', array( $pre_http_request, 'filter' ), 10 );
+	}
+
+	public function set_up() {
+		parent::set_up();
+		add_filter( 'pre_get_remote_metadata_by_actor', array( get_called_class(), 'pre_get_remote_metadata_by_actor' ), 10, 2 );
+		_delete_all_posts();
+	}
+
+	public function tear_down() {
+		remove_filter( 'pre_get_remote_metadata_by_actor', array( get_called_class(), 'pre_get_remote_metadata_by_actor' ) );
+		parent::tear_down();
+	}
+
+	public static function pre_get_remote_metadata_by_actor( $pre, $actor ) {
+		if ( isset( self::$users[ $actor ] ) ) {
+			return self::$users[ $actor ];
+		}
+		foreach ( self::$users as $username => $data ) {
+			if ( $data['url'] === $actor ) {
+				return $data;
+			}
+		}
+		return $pre;
+	}
+
+	public static function http_request_host_is_external( $in, $host ) {
+		if ( in_array( $host, array( 'example.com', 'example.org' ), true ) ) {
+			return true;
+		}
+		return $in;
+	}
+	public static function http_request_args( $args, $url ) {
+		if ( in_array( wp_parse_url( $url, PHP_URL_HOST ), array( 'example.com', 'example.org' ), true ) ) {
+			$args['reject_unsafe_urls'] = false;
+		}
+		return $args;
+	}
+
+	public static function pre_http_request( $preempt, $request, $url ) {
+		return array(
+			'headers'  => array(
+				'content-type' => 'text/json',
+			),
+			'body'     => '',
+			'response' => array(
+				'code' => 202,
+			),
+		);
+	}
+
+	public static function http_response( $response, $args, $url ) {
+		return $response;
+	}
+}

tests/test-class-activitypub-activity.php

@@ -0,0 +1,31 @@
+<?php
+class Test_Activitypub_Activity extends WP_UnitTestCase {
+	public function test_activity_mentions() {
+		$post = \wp_insert_post(
+			array(
+				'post_author' => 1,
+				'post_content' => '@alex hello',
+			)
+		);
+
+		add_filter(
+			'activitypub_extract_mentions',
+			function( $mentions ) {
+				$mentions['@alex'] = 'https://example.com/alex';
+				return $mentions;
+			},
+			10
+		);
+
+		$activitypub_post = new \Activitypub\Model\Post( $post );
+
+		$activitypub_activity = new \Activitypub\Model\Activity( 'Create', \Activitypub\Model\Activity::TYPE_FULL );
+		$activitypub_activity->from_post( $activitypub_post );
+
+		$this->assertContains( \get_rest_url( null, '/activitypub/1.0/users/1/followers' ), $activitypub_activity->get_cc() );
+		$this->assertContains( 'https://example.com/alex', $activitypub_activity->get_cc() );
+
+		remove_all_filters( 'activitypub_extract_mentions' );
+		\wp_trash_post( $post );
+	}
+}

tests/test-class-activitypub-hashtag.php

@@ -4,29 +4,50 @@ class Test_Activitypub_Hashtag extends WP_UnitTestCase {
 	 * @dataProvider the_content_provider
 	 */
 	public function test_the_content( $content, $content_with_hashtag ) {
-		$content = \Activitypub\Hashtag::the_content( $content );
-
-		$this->assertEquals( $content_with_hashtag, $content );
-	}
-
-	public function the_content_provider() {
 		\wp_create_term( 'object', 'post_tag' );
+		\wp_create_term( 'touch', 'post_tag' );
+		\wp_create_term( 'ccc', 'post_tag' );
 		$object = \get_term_by( 'name', 'object', 'post_tag' );
 		$link = \get_term_link( $object, 'post_tag' );
 
+		$content = \Activitypub\Hashtag::the_content( $content );
+
+		$this->assertEquals( sprintf( $content_with_hashtag, $link ), $content );
+	}
+
+	public function the_content_provider() {
+		$code = '<code>text with some #object and <a> tag inside</code>';
+		$style = <<<ENDSTYLE
+<style type="text/css">
+<![CDATA[
+color: #ccc;
+]]>
+</style>
+ENDSTYLE;
+		$pre = <<<ENDPRE
+<pre>
+Please don't #touch
+  this.
+</pre>
+ENDPRE;
+		$textarea = '<textarea name="test" rows="20">color: #ccc</textarea>';
 		return array(
 			array( 'test', 'test' ),
 			array( '#test', '#test' ),
 			array( 'hallo #test test', 'hallo #test test' ),
-			array( 'hallo #object test', 'hallo <a rel="tag" class="u-tag u-category" href="' . $link . '">#object</a> test' ),
+			array( 'hallo #object test', 'hallo <a rel="tag" class="u-tag u-category" href="%s">#object</a> test' ),
-			array( '#object test', '<a rel="tag" class="u-tag u-category" href="' . $link . '">#object</a> test' ),
+			array( '#object test', '<a rel="tag" class="u-tag u-category" href="%s">#object</a> test' ),
 			array( 'hallo <a href="http://test.test/#object">test</a> test', 'hallo <a href="http://test.test/#object">test</a> test' ),
 			array( 'hallo <a href="http://test.test/#object">#test</a> test', 'hallo <a href="http://test.test/#object">#test</a> test' ),
-			array( '<div>hallo #object test</div>', '<div>hallo <a rel="tag" class="u-tag u-category" href="' . $link . '">#object</a> test</div>' ),
+			array( '<div>hallo #object test</div>', '<div>hallo <a rel="tag" class="u-tag u-category" href="%s">#object</a> test</div>' ),
-			array( '<div>hallo #object</div>', '<div>hallo <a rel="tag" class="u-tag u-category" href="' . $link . '">#object</a></div>' ),
+			array( '<div>hallo #object</div>', '<div>hallo <a rel="tag" class="u-tag u-category" href="%s">#object</a></div>' ),
 			array( '<div>#object</div>', '<div>#object</div>' ),
 			array( '<a>#object</a>', '<a>#object</a>' ),
 			array( '<div style="color: #ccc;">object</a>', '<div style="color: #ccc;">object</a>' ),
+			array( $code, $code ),
+			array( $style, $style ),
+			array( $textarea, $textarea ),
+			array( $pre, $pre ),
 		);
 	}
 }

tests/test-class-activitypub-mention.php

@@ -0,0 +1,46 @@
+<?php
+class Test_Activitypub_Mention extends ActivityPub_TestCase_Cache_HTTP {
+	public static $users = array(
+		'username@example.org' => array(
+			'url'  => 'https://example.org/users/username',
+			'name' => 'username',
+		),
+	);
+	/**
+	 * @dataProvider the_content_provider
+	 */
+	public function test_the_content( $content, $content_with_mention ) {
+		add_filter( 'pre_get_remote_metadata_by_actor', array( get_called_class(), 'pre_get_remote_metadata_by_actor' ), 10, 2 );
+		$content = \Activitypub\Mention::the_content( $content );
+		remove_filter( 'pre_get_remote_metadata_by_actor', array( get_called_class(), 'pre_get_remote_metadata_by_actor' ) );
+
+		$this->assertEquals( $content_with_mention, $content );
+	}
+
+	public function the_content_provider() {
+		$code = 'hallo <code>@username@example.org</code> test';
+		$pre = <<<ENDPRE
+<pre>
+Please don't mention @username@example.org
+  here.
+</pre>
+ENDPRE;
+		return array(
+			array( 'hallo @username@example.org test', 'hallo <a rel="mention" class="u-url mention" href="https://example.org/users/username">@<span>username</span></a> test' ),
+			array( 'hallo @pfefferle@notiz.blog test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@<span>pfefferle</span></a> test' ),
+			array( 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@<span>pfefferle</span>@notiz.blog</a> test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@<span>pfefferle</span>@notiz.blog</a> test' ),
+			array( 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@pfefferle@notiz.blog</a> test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/author/matthias-pfefferle/">@pfefferle@notiz.blog</a> test' ),
+			array( 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/@pfefferle/">@pfefferle@notiz.blog</a> test', 'hallo <a rel="mention" class="u-url mention" href="https://notiz.blog/@pfefferle/">@pfefferle@notiz.blog</a> test' ),
+			array( $code, $code ),
+			array( $pre, $pre ),
+		);
+	}
+
+	public static function pre_get_remote_metadata_by_actor( $pre, $actor ) {
+		$actor = ltrim( $actor, '@' );
+		if ( isset( self::$users[ $actor ] ) ) {
+			return self::$users[ $actor ];
+		}
+		return $pre;
+	}
+}

tests/test-functions.php

@@ -0,0 +1,9 @@
+<?php
+class Test_Functions extends ActivityPub_TestCase_Cache_HTTP {
+	public function test_get_remote_metadata_by_actor() {
+		$metadata = \ActivityPub\get_remote_metadata_by_actor( 'pfefferle@notiz.blog' );
+		$this->assertEquals( 'https://notiz.blog/author/matthias-pfefferle/', $metadata['url'] );
+		$this->assertEquals( 'pfefferle', $metadata['preferredUsername'] );
+		$this->assertEquals( 'Matthias Pfefferle', $metadata['name'] );
+	}
+}