Federated comments: images attached to mention are not saved in local comment

[jeherve]

Quick summary

When someone replies to one of your posts and includes an image in their reply, that image will not appear in the local comment you receive on your site.

Steps to reproduce

1. Publish a post on an ActivityPub-enabled site.
2. Have someone reply to that post from a Mastodon account, for example.
3. In their reply, they should include an image.
   • In the ActivityPub representation of that reply, you will see an attachment key with information about the image that was sent.
4. Check the comment that was saved on your site based on that reply
   • It will not include the image.

Site owner impact

Fewer than 20% of the total website/platform users

Severity

Minor

What other impact(s) does this issue have?

No response

If a workaround is available, please outline it here.

Here is an example:

• Original post: https://herve.bzh/wordpress-wordland-and-the-open-web/
• Reply on the Fediverse: https://mastodon.social/@wpcommaven/114737070053878940
• ActivityPub representation of that reply:

Details

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    {
      "ostatus": "[http://ostatus.org#](http://ostatus.org/#)",
      "atomUri": "ostatus:atomUri",
      "inReplyToAtomUri": "ostatus:inReplyToAtomUri",
      "conversation": "ostatus:conversation",
      "sensitive": "as:sensitive",
      "toot": "http://joinmastodon.org/ns#",
      "votersCount": "toot:votersCount",
      "blurhash": "toot:blurhash",
      "focalPoint": {
        "@container": "@list",
        "@id": "toot:focalPoint"
      }
    }
  ],
  "id": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940",
  "type": "Note",
  "summary": null,
  "inReplyTo": "https://herve.bzh/?p=128456",
  "published": "2025-06-24T07:05:49Z",
  "url": "https://mastodon.social/@wpcommaven/114737070053878940",
  "attributedTo": "https://mastodon.social/users/wpcommaven",
  "to": [
    "https://www.w3.org/ns/activitystreams#Public"
  ],
  "cc": [
    "https://mastodon.social/users/wpcommaven/followers",
    "https://herve.bzh/author/jeremy/",
    "https://mastodon.social/users/davew"
  ],
  "sensitive": false,
  "atomUri": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940",
  "inReplyToAtomUri": "https://herve.bzh/?p=128456",
  "conversation": "tag:mastodon.social,2025-06-23:objectId=1030709232:objectType=Conversation",
  "content": "\u003cp\u003e\u003cspan class=\"h-card\" translate=\"no\"\u003e\u003ca href=\"https://herve.bzh/author/jeremy/\" class=\"u-url mention\"\u003e@\u003cspan\u003ejeremy\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e \u003cspan class=\"h-card\" translate=\"no\"\u003e\u003ca href=\"https://mastodon.social/@davew\" class=\"u-url mention\"\u003e@\u003cspan\u003edavew\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e Interesting and thanks for this, Dave. \u003c/p\u003e\u003cp\u003eI did a quick (OK, maybe not so quick) post on a standalone private test site. Who can I invite as an Editor to see the results? (And thanks for taking my mind off \u0026quot;things\u0026quot;.)\u003c/p\u003e",
  "contentMap": {
    "en": "\u003cp\u003e\u003cspan class=\"h-card\" translate=\"no\"\u003e\u003ca href=\"https://herve.bzh/author/jeremy/\" class=\"u-url mention\"\u003e@\u003cspan\u003ejeremy\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e \u003cspan class=\"h-card\" translate=\"no\"\u003e\u003ca href=\"https://mastodon.social/@davew\" class=\"u-url mention\"\u003e@\u003cspan\u003edavew\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e Interesting and thanks for this, Dave. \u003c/p\u003e\u003cp\u003eI did a quick (OK, maybe not so quick) post on a standalone private test site. Who can I invite as an Editor to see the results? (And thanks for taking my mind off \u0026quot;things\u0026quot;.)\u003c/p\u003e"
  },
  "attachment": [
    {
      "type": "Document",
      "mediaType": "image/jpeg",
      "url": "https://files.mastodon.social/media_attachments/files/114/737/052/547/540/173/original/75b1722d6a7de354.jpg",
      "name": "An experimental test post written in Dave Winer's WordLand posting app. Truncated image showing an editing box with tool bars, the writing box and and part of an inserted image. ",
      "blurhash": "UcQ9=tay%Nt7_4WBM_ayM_j[a#ay%MWBRjay",
      "focalPoint": [
        0.0,
        0.0
      ],
      "width": 800,
      "height": 514
    }
  ],
  "tag": [
    {
      "type": "Mention",
      "href": "https://herve.bzh/author/jeremy/",
      "name": "@jeremy@herve.bzh"
    },
    {
      "type": "Mention",
      "href": "https://mastodon.social/users/davew",
      "name": "@davew"
    }
  ],
  "replies": {
    "id": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940/replies",
    "type": "Collection",
    "first": {
      "type": "CollectionPage",
      "next": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940/replies?only_other_accounts=true\u0026page=true",
      "partOf": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940/replies",
      "items": []
    }
  },
  "likes": {
    "id": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940/likes",
    "type": "Collection",
    "totalItems": 0
  },
  "shares": {
    "id": "https://mastodon.social/users/wpcommaven/statuses/114737070053878940/shares",
    "type": "Collection",
    "totalItems": 0
  }
}

• Locally saved comment:

Details

+----------------------+-------------------------------------------------------+
| Field                | Value                                                 |
+----------------------+-------------------------------------------------------+
| comment_ID           | 3063                                                  |
| comment_post_ID      | 128456                                                |
| comment_author       | Jen T 🎗                                               |
| comment_author_email | wpcommaven@mastodon.social                            |
| comment_author_url   | https://mastodon.social/@wpcommaven                   |
| comment_author_IP    | xxx.xx.xxx.xx                                         |
| comment_date         | 2025-06-24 09:05:50                                   |
| comment_date_gmt     | 2025-06-24 07:05:50                                   |
| comment_content      | <p><a href="https://herve.bzh/author/jeremy/" rel="ug |
|                      | c">@jeremy</a> <a href="https://mastodon.social/@dave |
|                      | w" rel="nofollow ugc">@davew</a> Interesting and than |
|                      | ks for this, Dave. </p><p>I did a quick (OK, maybe no |
|                      | t so quick) post on a standalone private test site. W |
|                      | ho can I invite as an Editor to see the results? (And |
|                      |  thanks for taking my mind off &quot;things&quot;.)</ |
|                      | p>                                                    |
| comment_karma        | 0                                                     |
| comment_approved     | 1                                                     |
| comment_agent        | Mastodon/4.4.0-nightly.2025-06-21 (http.rb/5.3.1; +ht |
|                      | tps://mastodon.social/)                               |
| comment_type         | comment                                               |
| comment_parent       | 0                                                     |
| user_id              | 0                                                     |
| url                  | https://mastodon.social/@wpcommaven/11473707005387894 |
+----------------------+-------------------------------------------------------+

[obenland]

This sounds familiar, I feel like there was a ticket about that previously, @pfefferle? I couldn't find it.

IIRC, it's currently not supported because WordPress doesn't allow images in comments? And/or it would be hotlinking images?

I suppose we could re-use the image sideload logic from the Mastodon importer and always move comments with images in the moderation queue, to support it?

[pfefferle]

sure, but we would have to do that on every update too... and delete old versions of the image...

[Jiwoon-Kim]

This issue will probably require using a gallery block within comments via the Blocks Everywhere plugin, while implementing both a content warning and a blur effect at the same time.
When adding the content warning checkbox, it might be relatively simple to adapt the Gutenberg Details block and use the post title as the warning message.
https://kowporg.wordpress.com/2025/06/25/cw/
https://mastodon.social/@thaumiel999/114733459718225049

[Jiwoon-Kim]

Just for reference, it’s possible to post images in comments in certain cases.
https://kowporg.wordpress.com/2025/05/17/emoji-debug/comment-page-1/#comment-1

[jeherve]

And/or it would be hotlinking images?

I think it would be fine to hotlink images in this scenario, since the actor remains in control of the comment and may update or delete it on their end at any point?

[Jiwoon-Kim]

@jeherve I have a question: Since WordPress site administrators have the ability to modify federated replies from other users on their site, does this introduce any potential risks of message tampering or trust issues across the wider Fediverse network?

[jeherve]

Since the question is not directly related to this issue, I would recommend creating a new issue if you want to discuss this in detail, to avoid going off-topic and derailing a conversation.

That said, I don't think that is worth discussing. The ActivityPub plugin explicitely disables comment editing for federated comments in the WordPress UI:

wordpress-activitypub/includes/wp-admin/class-admin.php

Line 253 in 1056810

* Disables the edit_comment capability for federated comments.

You can of course always edit the comments directly in the database, but the same holds true for any Fediverse instance ; admins ultimately control what's stored on the instance. I don't think that's really an issue though; since the content is federated, one can always verify the content by checking the instance where it was originally posted.

[Jiwoon-Kim]

I see. So, it sounds like being able to edit another Fediverse actor's comment on a WordPress.com site is a bug. But as you said, it doesn't seem like a critical issue.

By the way, it seems that when using the Jetpack app, it’s also possible to edit comments from other Fediverse actors on self-hosted sites. I’m not sure whether this detail should be addressed in the ActivityPub repository or in the Jetpack app repository.

Personally, I believe that at this stage, it’s more important to focus on moving quickly and shaping the overall framework rather than getting caught up in minor details. Still, I thought it would be good for you to be aware of areas that might need improvement down the line.

[jeherve]

it sounds like being able to edit another Fediverse actor's comment on a WordPress.com site is a bug

Yes, this is a separate issue. I opened #1856 to track this.