Changed: Moved password check to is_post_disabled function. (#1246)

* move password check to `is_post_disabled` check

fix #1244

* add changelog

* added tests

* fix phpcs

Author: pfefferle

CHANGELOG.md

@@ -9,7 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-* Improved content negotiation and AUTHORIZED_FETCH support for third-party plugins
+* Improved content negotiation and AUTHORIZED_FETCH support for third-party plugins.
+* Moved password check to `is_post_disabled` function.
 
 ### Fixed
 

includes/functions.php

@@ -379,13 +379,21 @@ function is_activitypub_request() {
  * @return boolean True if the post is disabled, false otherwise.
  */
 function is_post_disabled( $post ) {
-	$post       = \get_post( $post );
-	$disabled   = false;
+	$post     = \get_post( $post );
+	$disabled = false;
+
+	if ( ! $post ) {
+		return true;
+	}
+
 	$visibility = \get_post_meta( $post->ID, 'activitypub_content_visibility', true );
 
 	if (
 		ACTIVITYPUB_CONTENT_VISIBILITY_LOCAL === $visibility ||
-		! \post_type_supports( $post->post_type, 'activitypub' )
+		ACTIVITYPUB_CONTENT_VISIBILITY_PRIVATE === $visibility ||
+		! \post_type_supports( $post->post_type, 'activitypub' ) ||
+		'private' === $post->post_status ||
+		! empty( $post->post_password )
 	) {
 		$disabled = true;
 	}

includes/scheduler/class-post.php

@@ -78,11 +78,6 @@ public static function schedule_post_activity( $new_status, $old_status, $post )
 			return;
 		}
 
-		// Do not send activities if post is password protected.
-		if ( \post_password_required( $post ) ) {
-			return;
-		}
-
 		switch ( $new_status ) {
 			case 'publish':
 				$type = ( 'publish' === $old_status ) ? 'Update' : 'Create';

readme.txt

@@ -135,7 +135,8 @@ For reasons of data protection, it is not possible to see the followers of other
 
 * Added: Outbox queue
 * Changed: Rewrite the current dispatcher system, to use the Outbox instead of a Scheduler.
-* Changed: Improved content negotiation and AUTHORIZED_FETCH support for third-party plugins
+* Changed: Improved content negotiation and AUTHORIZED_FETCH support for third-party plugins.
+* Changed: Moved password check to `is_post_disabled` function.
 * Fixed: Handle deletes from remote servers that leave behind an accessible Tombstone object.
 * Fixed: No longer parses tags for post types that don't support Activitypub.
 * Fixed: rel attribute will now contain no more than one "me" value.

tests/includes/class-test-functions.php

@@ -299,4 +299,82 @@ public function test_is_activity_with_invalid_input() {
 			);
 		}
 	}
+
+	/**
+	 * Test is_post_disabled function.
+	 *
+	 * @covers ::is_post_disabled
+	 */
+	public function test_is_post_disabled() {
+		// Test standard public post.
+		$public_post_id = self::factory()->post->create();
+		$this->assertFalse( \Activitypub\is_post_disabled( $public_post_id ) );
+
+		// Test local-only post.
+		$local_post_id = self::factory()->post->create();
+		add_post_meta( $local_post_id, 'activitypub_content_visibility', ACTIVITYPUB_CONTENT_VISIBILITY_LOCAL );
+		$this->assertTrue( \Activitypub\is_post_disabled( $local_post_id ) );
+
+		// Test private post.
+		$private_post_id = self::factory()->post->create(
+			array(
+				'post_status' => 'private',
+			)
+		);
+		$this->assertTrue( \Activitypub\is_post_disabled( $private_post_id ) );
+
+		// Test password protected post.
+		$password_post_id = self::factory()->post->create(
+			array(
+				'post_password' => 'test123',
+			)
+		);
+		$this->assertTrue( \Activitypub\is_post_disabled( $password_post_id ) );
+
+		// Test unsupported post type.
+		register_post_type( 'unsupported', array() );
+		$unsupported_post_id = self::factory()->post->create(
+			array(
+				'post_type' => 'unsupported',
+			)
+		);
+		$this->assertTrue( \Activitypub\is_post_disabled( $unsupported_post_id ) );
+		unregister_post_type( 'unsupported' );
+
+		// Test with filter.
+		add_filter( 'activitypub_is_post_disabled', '__return_true' );
+		$this->assertTrue( \Activitypub\is_post_disabled( $public_post_id ) );
+		remove_filter( 'activitypub_is_post_disabled', '__return_true' );
+
+		// Clean up.
+		wp_delete_post( $public_post_id, true );
+		wp_delete_post( $local_post_id, true );
+		wp_delete_post( $private_post_id, true );
+		wp_delete_post( $password_post_id, true );
+	}
+
+	/**
+	 * Test is_post_disabled with private visibility.
+	 *
+	 * @covers ::is_post_disabled
+	 */
+	public function test_is_post_disabled_private_visibility() {
+		$visible_private_post_id = self::factory()->post->create();
+
+		add_post_meta( $visible_private_post_id, 'activitypub_content_visibility', ACTIVITYPUB_CONTENT_VISIBILITY_PRIVATE );
+		$this->assertFalse( \Activitypub\is_post_disabled( $visible_private_post_id ) );
+
+		wp_delete_post( $visible_private_post_id, true );
+	}
+
+	/**
+	 * Test is_post_disabled with invalid post.
+	 *
+	 * @covers ::is_post_disabled
+	 */
+	public function test_is_post_disabled_invalid_post() {
+		$this->assertTrue( \Activitypub\is_post_disabled( 0 ) );
+		$this->assertTrue( \Activitypub\is_post_disabled( null ) );
+		$this->assertTrue( \Activitypub\is_post_disabled( 999999 ) );
+	}
 }