Improve Undo handler object validation and defaults

Adds a default value for the 'type' field in handle_undo to prevent undefined index errors. Updates object attribute validation to only check required fields if 'object' is an array, allowing string/URI objects. Adds a test case to ensure URI objects pass validation.

Author: pfefferle

includes/handler/class-undo.php

@@ -33,7 +33,7 @@ public static function init() {
 	 * @param int|null $user_id  The ID of the user who initiated the "Undo" activity.
 	 */
 	public static function handle_undo( $activity, $user_id ) {
-		$type    = $activity['object']['type'];
+		$type    = $activity['object']['type'] ?? 'Announce';
 		$success = false;
 		$result  = null;
 
@@ -48,10 +48,7 @@ public static function handle_undo( $activity, $user_id ) {
 					$success = Followers::remove( $post, $user_id );
 				}
 			}
-		}
-
-		// Handle "Undo" requests for "Like" and "Create" activities.
-		if ( in_array( $type, array( 'Like', 'Create', 'Announce' ), true ) ) {
+		} if ( in_array( $type, array( 'Like', 'Create', 'Announce' ), true ) ) { // Handle "Undo" requests for "Like" and "Create" activities.
 			if ( ! ACTIVITYPUB_DISABLE_INCOMING_INTERACTIONS ) {
 				$object_id = object_to_uri( $activity['object'] );
 				$result    = Comment::object_id_to_comment( esc_url_raw( $object_id ) );
@@ -107,15 +104,17 @@ public static function validate_object( $valid, $param, $request ) {
 			return false;
 		}
 
-		$required_object_attributes = array(
-			'id',
-			'type',
-			'actor',
-			'object',
-		);
+		if ( \is_array( $json_params['object'] ) ) {
+			$required_object_attributes = array(
+				'id',
+				'type',
+				'actor',
+				'object',
+			);
 
-		if ( ! empty( \array_diff( $required_object_attributes, \array_keys( $json_params['object'] ) ) ) ) {
-			return false;
+			if ( ! empty( \array_diff( $required_object_attributes, \array_keys( $json_params['object'] ) ) ) ) {
+				return false;
+			}
 		}
 
 		return $valid;

tests/includes/handler/class-test-undo.php

@@ -452,6 +452,16 @@ public function validate_object_provider() {
 				false,
 				'Missing object.object should fail validation',
 			),
+			'uri_object'                        => array(
+				array(
+					'type'   => 'Undo',
+					'actor'  => 'https://example.com/actor',
+					'object' => 'https://example.com/activity/123',
+				),
+				true,
+				true,
+				'URI object should pass validation',
+			),
 		);
 	}