From 595220e088b8c84c64f1bf4c528bf1f85d418c28 Mon Sep 17 00:00:00 2001
From: Shlee <github@shl.ee>
Date: Tue, 11 Aug 2026 22:38:22 +0930
Subject: [PATCH] Update Helpers.php

---
 app/Util/ActivityPub/Helpers.php | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/app/Util/ActivityPub/Helpers.php b/app/Util/ActivityPub/Helpers.php
index 84b62f906..6323a25fe 100644
--- a/app/Util/ActivityPub/Helpers.php
+++ b/app/Util/ActivityPub/Helpers.php
@@ -555,7 +555,19 @@ class Helpers
         $idDomain = parse_url($id, PHP_URL_HOST);
         $urlDomain = parse_url($url, PHP_URL_HOST);
 
-        return $idDomain && $urlDomain;
+        if (! $idDomain || ! $urlDomain) {
+            return false;
+        }
+
+        $attributedTo = $activity['attributedTo'] ?? $activity['object']['attributedTo'] ?? null;
+        if ($attributedTo) {
+            $authorDomain = parse_url(self::pluckval($attributedTo), PHP_URL_HOST);
+            if ($authorDomain && strtolower($idDomain) !== strtolower($authorDomain)) {
+                return false;
+            }
+        }
+
+        return true;
     }
 
     /**
@@ -649,7 +661,14 @@ class Helpers
      */
     public static function validateStatusDomains(string $id, string $url): bool
     {
-        return self::validateUrl($id) && self::validateUrl($url);
+        if (! self::validateUrl($id) || ! self::validateUrl($url)) {
+            return false;
+        }
+
+        $idDomain = parse_url($id, PHP_URL_HOST);
+        $urlDomain = parse_url($url, PHP_URL_HOST);
+
+        return $idDomain && $urlDomain && strtolower($idDomain) === strtolower($urlDomain);
     }
 
     /**