Skip to content

Conversation

@pfefferle
Copy link
Member

Fixes #2832

Related to #1441

Proposed changes:

  • Fix rel="me" not being added to Extra Fields links that are already wrapped in <a> tags (e.g., from the block editor)
  • Add new add_rel_me_to_links() method that uses WP_HTML_Tag_Processor to inject "me" into the rel attribute of all links
  • Both PropertyValue HTML and Link attachments now include rel="me" for proper Mastodon/fediverse verification

Background

When users create Extra Fields using the block editor, URLs are often already wrapped in <a> tags before the activitypub_link_rel filter runs. These pre-linked URLs bypassed the filter, resulting in no rel="me" attribute being added.

Before (broken):

{"type":"Link","name":"Blog","href":"https://example.com","rel":["nofollow","noopener"]}

After (fixed):

{"type":"Link","name":"Blog","href":"https://example.com","rel":["nofollow","noopener","me"]}

Other information:

  • Have you written new tests for your changes, if applicable?

Testing instructions:

  1. Create an Extra Field for a user or blog actor
  2. In the block editor, add a link (not a plain URL, but an actual <a> tag link)
  3. Save the Extra Field
  4. Fetch the actor JSON: curl -H "Accept: application/activity+json" https://yoursite.com/@username
  5. Verify the attachment includes rel: ["me"] in the Link type and rel="me" in the PropertyValue HTML

Changelog entry

  • Automatically create a changelog entry from the details below.
Changelog Entry Details

Significance

  • Patch

Type

  • Fixed - for any bug fixes

Message

Ensure Extra Fields links always include rel="me" for Mastodon verification.

When users create Extra Fields using the block editor, URLs are often
already wrapped in <a> tags before the activitypub_link_rel filter runs.
These pre-linked URLs bypassed the filter, resulting in no rel="me"
attribute being added.

This fix ensures all links in Extra Fields have rel="me" for proper
Mastodon/fediverse verification by:

1. Adding a new add_rel_me_to_links() method that uses WP_HTML_Tag_Processor
   to inject "me" into the rel attribute of all <a> tags
2. Processing content through this method before creating attachments
3. Both PropertyValue HTML and Link attachments now include rel="me"

Fixes #2832
Related to #1441
Copilot AI review requested due to automatic review settings February 4, 2026 15:38
@pfefferle pfefferle self-assigned this Feb 4, 2026
@pfefferle pfefferle requested a review from a team February 4, 2026 15:38
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes an issue where rel="me" attributes were not being added to Extra Fields URLs that were already wrapped in <a> tags (e.g., from the block editor), preventing proper Mastodon/fediverse verification.

Changes:

  • Added add_rel_me_to_links() method using WP_HTML_Tag_Processor to inject "me" into rel attributes of existing links
  • Updated fields_to_attachments() to process content through the new method before creating attachments
  • Added comprehensive test coverage for pre-linked URLs with various rel attribute scenarios

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
includes/collection/class-extra-fields.php Implements new add_rel_me_to_links() method and integrates it into the attachment generation flow
tests/phpunit/tests/includes/collection/class-test-extra-fields.php Adds three test cases covering pre-linked URLs without rel, with existing rel, and with existing rel="me"
.github/changelog/2874-from-description Adds changelog entry documenting the bug fix

Comment on lines +120 to +121
// PropertyValue should have "me" exactly once in the HTML.
$this->assertEquals( 1, \substr_count( $attachments[0]['value'], ' me' ) + \substr_count( $attachments[0]['value'], '"me' ) );
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test logic is fragile and could produce false positives. It counts occurrences of ' me' and '"me' separately, which could match unintended strings like 'some' or 'home'. A more reliable approach would be to parse the rel attribute value and count 'me' as a distinct token within it, or use a regex that specifically matches 'me' as a word boundary within the rel attribute.

Suggested change
// PropertyValue should have "me" exactly once in the HTML.
$this->assertEquals( 1, \substr_count( $attachments[0]['value'], ' me' ) + \substr_count( $attachments[0]['value'], '"me' ) );
// PropertyValue should have "me" exactly once in the rel attribute.
$rel_match = array();
\preg_match( '/\brel="([^"]*)"/', $attachments[0]['value'], $rel_match );
$rel_value = isset( $rel_match[1] ) ? $rel_match[1] : '';
$this->assertEquals( 1, \preg_match_all( '/\bme\b/', $rel_value ) );

Copilot uses AI. Check for mistakes.

while ( $tags->next_tag( 'A' ) ) {
$rel = $tags->get_attribute( 'rel' );
$rel_parts = $rel && \is_string( $rel ) ? \explode( ' ', $rel ) : array();
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rel attribute value should be trimmed before exploding to handle cases where the attribute has leading/trailing whitespace (e.g., rel=' nofollow noopener '). Without trimming, explode will create empty string elements that could cause issues. Use trim( $rel ) before splitting.

Suggested change
$rel_parts = $rel && \is_string( $rel ) ? \explode( ' ', $rel ) : array();
$rel_parts = $rel && \is_string( $rel ) ? \explode( ' ', \trim( $rel ) ) : array();

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants