[pfefferle]

Fixes #

Proposed changes:

• Interactions::update_comment() only checked the owner of a comment when the owner's actor post still existed, and comments without a recorded owner could be updated by any actor. Now a recorded owner has to match the Update's actor, and an owner whose actor post is gone is rejected. A comment without a recorded owner (from before the mapping in 7.6.0) can only be updated from the host of its id, the same rule add_comment() uses.
• The comment is now looked up by object_to_uri( $activity['object'] ), the same value add_comment() stores as source_id, and the host check uses that value as well. For a Note nothing changes. Media replies (Image, Video, ...) were stored under their url but looked up by id, so they could never be updated. That works now.
• Inbox::undo() let an item without a stored actor be undone by anyone. Now the Undo has to come from the host of the activity's id. Every item the plugin writes has the actor, so this only matters for rows that were not written by the plugin.
• When a Move merges two cached actors, the old actor post is deleted, but its comments and Reader posts still pointed at it. They now point at the new actor, so avatars keep working, the new account can edit its replies and a later Delete of the new account finds them.

Other information:

• Have you written new tests for your changes, if applicable?

Comments whose owner's actor post is gone can no longer be edited by anyone, also not by the author if they come back under a new actor post. That should be rare now, because the Move merge no longer leaves them behind.

Testing instructions:

• vendor/bin/phpunit --filter 'Test_Interactions|Test_Inbox|Test_Move'
• Reply to a post from Mastodon, edit the reply, the comment should update.
• Send an Update for that reply from an actor on another host, the comment should stay as it is.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message