Merge branch 'trunk' into add/content-visibility

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.3.3] - 2024-10-09
+
+### Fixed
+
+* Sanitization callback
+
+### Improved
+
+* A lot of PHPCS cleanups
+* Prepare multi-lang support
+
 ## [3.3.2] - 2024-10-02
 
 ### Fixed
@@ -958,6 +969,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * initial
 
+[3.3.3]: https://github.com/Automattic/wordpress-activitypub/compare/3.3.2...3.3.3
 [3.3.2]: https://github.com/Automattic/wordpress-activitypub/compare/3.3.1...3.3.2
 [3.3.1]: https://github.com/Automattic/wordpress-activitypub/compare/3.3.0...3.3.1
 [3.3.0]: https://github.com/Automattic/wordpress-activitypub/compare/3.2.5...3.3.0

README.md

@@ -3,7 +3,7 @@
 **Tags:** OStatus, fediverse, activitypub, activitystream  
 **Requires at least:** 5.5  
 **Tested up to:** 6.6  
-**Stable tag:** 3.3.2  
+**Stable tag:** 3.3.3  
 **Requires PHP:** 7.0  
 **License:** MIT  
 **License URI:** http://opensource.org/licenses/MIT  
@@ -150,6 +150,12 @@ For reasons of data protection, it is not possible to see the followers of other
 
 ## Changelog ##
 
+### 3.3.3 ###
+
+* Fixed: Sanitization callback
+* Improved: A lot of PHPCS cleanups
+* Improved: Prepare multi-lang support
+
 ### 3.3.2 ###
 
 * Fixed: Keep priority of Icons

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/pfefferle/wordpress-activitypub/
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 3.3.2
+ * Version: 3.3.3
  * Author: Matthias Pfefferle & Automattic
  * Author URI: https://automattic.com/
  * License: MIT
@@ -22,7 +22,7 @@
 require_once __DIR__ . '/includes/compat.php';
 require_once __DIR__ . '/includes/functions.php';
 
-\define( 'ACTIVITYPUB_PLUGIN_VERSION', '3.3.2' );
+\define( 'ACTIVITYPUB_PLUGIN_VERSION', '3.3.3' );
 
 /**
  * Initialize the plugin constants.

includes/handler/class-create.php

@@ -95,6 +95,10 @@ public static function handle_create( $activity, $user_id, $activity_object = nu
 	public static function validate_object( $valid, $param, $request ) {
 		$json_params = $request->get_json_params();
 
+		if ( empty( $json_params['type'] ) ) {
+			return false;
+		}
+
 		if (
 			'Create' !== $json_params['type'] ||
 			is_wp_error( $request )
@@ -109,6 +113,10 @@ public static function validate_object( $valid, $param, $request ) {
 			'content',
 		);
 
+		if ( ! is_array( $object ) ) {
+			return false;
+		}
+
 		if ( array_intersect( $required, array_keys( $object ) ) !== $required ) {
 			return false;
 		}

includes/rest/class-inbox.php

@@ -13,7 +13,6 @@
 use Activitypub\Collection\Users as User_Collection;
 
 use function Activitypub\get_context;
-use function Activitypub\object_to_uri;
 use function Activitypub\url_to_authorid;
 use function Activitypub\get_rest_url_by_path;
 use function Activitypub\get_masked_wp_version;
@@ -244,7 +243,7 @@ public static function user_inbox_post_parameters() {
 
 		$params['actor'] = array(
 			'required'          => true,
-			'sanitize_callback' => 'object_to_uri',
+			'sanitize_callback' => '\Activitypub\object_to_uri',
 		);
 
 		$params['type'] = array(
@@ -277,6 +276,9 @@ public static function user_inbox_post_parameters() {
 	public static function shared_inbox_post_parameters() {
 		$params = self::user_inbox_post_parameters();
 
+		// A shared Inbox does not need a User-ID.
+		unset( $params['user_id'] );
+
 		$params['to'] = array(
 			'required'          => false,
 			'sanitize_callback' => function ( $param ) {

readme.txt

@@ -3,7 +3,7 @@ Contributors: automattic, pfefferle, mediaformat, mattwiebe, akirk, jeherve, nur
 Tags: OStatus, fediverse, activitypub, activitystream
 Requires at least: 5.5
 Tested up to: 6.6
-Stable tag: 3.3.2
+Stable tag: 3.3.3
 Requires PHP: 7.0
 License: MIT
 License URI: http://opensource.org/licenses/MIT
@@ -148,6 +148,12 @@ For reasons of data protection, it is not possible to see the followers of other
 
 == Changelog ==
 
+= 3.3.3 =
+
+* Fixed: Sanitization callback
+* Improved: A lot of PHPCS cleanups
+* Improved: Prepare multi-lang support
+
 = 3.3.2 =
 
 * Fixed: Keep priority of Icons