[pfefferle]

Proposed changes:

• A QuoteRequest or FeatureRequest is now only answered if it was sent to the actor who owns its object. Before, the handler always answered as the post author (or the featured actor), even when the request came in through the inbox of another user. The inbox only checks the blocks of the user it was delivered to, so a request sent to user B could get an Accept in the name of user A, past A's blocks.
• If the owner is not the recipient, the recipient declines the request with a Reject and nothing is stored.
• For quotes, the owner is the post author, or the blog when the author can't use ActivityPub, the same fallback queue_accept() already uses.
• I added a note to AGENTS.md, so the next request type gets the same check.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Create two users, A and B. Publish a post as A with the quote policy "Anyone".
• Send a QuoteRequest for A's post to B's inbox (/wp-json/activitypub/1.0/actors/{B}/inbox): it is rejected by B, and no _activitypub_quoted_by meta is added to the post.
• Send the same request to A's inbox: it is accepted as before.
• In blog mode, send the request to the blog's inbox: it is accepted by the blog as before.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Quote and feature requests are now only answered when they were sent to the account they ask.

The changelog entry is already committed in .github/changelog/fix-request-recipient.