API changes

README.md

@@ -3,7 +3,7 @@
 **Tags:** OStatus, fediverse, activitypub, activitystream  
 **Requires at least:** 4.7  
 **Tested up to:** 6.3  
-**Stable tag:** 1.0.5  
+**Stable tag:** 1.0.6  
 **Requires PHP:** 5.6  
 **License:** MIT  
 **License URI:** http://opensource.org/licenses/MIT  
@@ -105,6 +105,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [automattic/wordpress-activitypub](https://github.com/automattic/wordpress-activitypub).
 
+### 1.0.6 ###
+
+* Fixed: more restrictive request verification
+
 ### 1.0.5 ###
 
 * Fixed: compatibility with WebFinger and NodeInfo plugin

activitypub.php

@@ -3,7 +3,7 @@
  * Plugin Name: ActivityPub
  * Plugin URI: https://github.com/pfefferle/wordpress-activitypub/
  * Description: The ActivityPub protocol is a decentralized social networking protocol based upon the ActivityStreams 2.0 data format.
- * Version: 1.0.5
+ * Version: 1.0.6
  * Author: Matthias Pfefferle & Automattic
  * Author URI: https://automattic.com/
  * License: MIT

includes/rest/class-inbox.php

@@ -38,7 +38,7 @@ public static function register_routes() {
 			'/inbox',
 			array(
 				array(
-					'methods'             => WP_REST_Server::EDITABLE,
+					'methods'             => WP_REST_Server::CREATABLE,
 					'callback'            => array( self::class, 'shared_inbox_post' ),
 					'args'                => self::shared_inbox_post_parameters(),
 					'permission_callback' => '__return_true',
@@ -51,7 +51,7 @@ public static function register_routes() {
 			'/users/(?P<user_id>[\w\-\.]+)/inbox',
 			array(
 				array(
-					'methods'             => WP_REST_Server::EDITABLE,
+					'methods'             => WP_REST_Server::CREATABLE,
 					'callback'            => array( self::class, 'user_inbox_post' ),
 					'args'                => self::user_inbox_post_parameters(),
 					'permission_callback' => '__return_true',

includes/rest/class-server.php

@@ -86,7 +86,7 @@ public static function authorize_activitypub_requests( $response, $handler, $req
 		}
 
 		// POST-Requets are always signed
-		if ( 'post' === \strtolower( $request->get_method() ) ) {
+		if ( 'get' !== \strtolower( $request->get_method() ) ) {
 			$verified_request = Signature::verify_http_signature( $request );
 			if ( \is_wp_error( $verified_request ) ) {
 				return $verified_request;

readme.txt

@@ -3,7 +3,7 @@ Contributors: automattic, pfefferle, mediaformat, mattwiebe, akirk, jeherve, nur
 Tags: OStatus, fediverse, activitypub, activitystream
 Requires at least: 4.7
 Tested up to: 6.3
-Stable tag: 1.0.5
+Stable tag: 1.0.6
 Requires PHP: 5.6
 License: MIT
 License URI: http://opensource.org/licenses/MIT
@@ -105,6 +105,10 @@ Where 'blog' is the path to the subdirectory at which your blog resides.
 
 Project maintained on GitHub at [automattic/wordpress-activitypub](https://github.com/automattic/wordpress-activitypub).
 
+= 1.0.6 =
+
+* Fixed: more restrictive request verification
+
 = 1.0.5 =
 
 * Fixed: compatibility with WebFinger and NodeInfo plugin