[pfefferle]

Follow-up to #3968.

Proposed changes:

• Local delivery got the REST route by removing /wp-json from the inbox URL path. On a subdirectory install (/blog/wp-json/...), with index.php permalinks or with plain permalinks (?rest_route=...) that path is not a route, so valid local inboxes were rejected as activitypub_invalid_inbox. Before Only deliver locally to inbox routes #3968 the same deliveries ended in a 404.
• send_to_local_inbox() now uses core's WP_REST_Request::from_url(), the same way the Seek controller does. The inbox check from Only deliver locally to inbox routes #3968 is unchanged, and send_to_inboxes() still checks is_same_domain() before a local delivery.

Other information:

• Have you written new tests for your changes, if applicable?

test_local_delivery_only_reaches_inbox_routes() now runs with pretty, plain and index.php permalinks and on a /blog subdirectory. The old code fails the last three cases.

from_url() compares the URL with rest_url(), including scheme and host. A stored local inbox that differs only in http:// or a www. prefix was delivered before and is now rejected. This site's own rest_url() never produces such a URL, so it only affects old stored URLs.

Testing instructions:

• Run npm run env-test -- --filter=test_local_delivery_only_reaches_inbox_routes.
• On a site with plain permalinks, let one local user follow another (or the blog actor) and publish a post. The follower should get it without an activitypub_invalid_inbox error.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message