[pfefferle]

Fixes #

Proposed changes:

• Follow::handle_follow() added the follower to the actor whose inbox received the Follow, without looking at its object. It now resolves the object and only accepts the Follow when it names one of the recipients, and adds the follower to that actor. This is the same recipient check Quote_Request uses. With several recipients, the named one gets the follower instead of the first.
• Actors::get_id_by_resource() resolved https://<any host>/@name to a local user, because the http(s) branch never looked at the host. It now only resolves this site's host or the host it moved from, like the acct: branch already did.
• The host rule (folded host is the home host or activitypub_old_host) was written out in the acct: branch and in Application. It is now one function, is_local_host(), used in both branches and in Application. Each branch keeps its error code (activitypub_no_user_found for http(s), activitypub_wrong_host for acct:).

Other information:

• Have you written new tests for your changes, if applicable?

Callers that resolved a foreign /@name to a local actor no longer do: inbox recipient resolution, the blog actor check in Announce, WebFinger and Application. Old URLs keep resolving after a domain move.

Testing instructions:

• vendor/bin/phpunit --filter 'Test_Follow|Test_Actors|test_is_local_host'
• Follow the blog and a user from Mastodon, both should still be accepted.
• Look up https://other.example/@admin through Actors::get_id_by_resource(), it should return an error.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message