FormsAutoSubmit

5 hooks fired by FormsAutoSubmit: 4 filters and 1 actions across 5 call sites. 4 of the 5 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.

xpac_forms_autosubmit_allow_legacy_form_signature

Filter · 4 arguments · 1 call site

Filters whether legacy signatures that cover only form id and expiry may be accepted.

This compatibility path is deliberately disabled. Enabling it makes every answer in an intercepted link mutable and permits expiry zero, exactly the unsafe legacy contract. Use only while replacing old links with buildSignedUrl() output.

apply_filters( 'xpac_forms_autosubmit_allow_legacy_form_signature', false, $form, $canonical, $expiry )

• $allow (bool) — Whether the unsafe legacy signature is accepted.
• $form (WP_Post) — Form being submitted.
• $canonical (array) — Submitted values not covered by the legacy signature.
• $expiry (int) — Submitted expiry; zero means no expiry for legacy links.

Fired from:

• packages/FormsAutoSubmit/Addon.php:438

xpac_forms_autosubmit_link_ttl

Filter · 3 arguments · 1 call site

Filters the lifetime of a concrete auto-submit link.

The result is always clamped to five minutes through seven days. This is a validity window, not a promise that a scanner will not follow the GET link first.

apply_filters( 'xpac_forms_autosubmit_link_ttl', self::DEFAULT_LINK_TTL, $form, $canonical )

• $ttl (int) — Requested lifetime in seconds. Default one hour.
• $form (WP_Post) — Form the link will submit.
• $canonical (array) — Exact normalized values covered by the signature.

Fired from:

• packages/FormsAutoSubmit/Addon.php:316

xpac_forms_autosubmit_pre_submit

Action · 1 argument · 1 call site

do_action( 'xpac_forms_autosubmit_pre_submit', $submission )

Fired from:

• packages/FormsAutoSubmit/Addon.php:1054

xpac_forms_autosubmit_unsafe_fields

Filter · 2 arguments · 1 call site

Filters the fields an auto-submit link is refused for carrying.

Returning an empty array restores the behaviour where a link could satisfy a required file field with arbitrary text, tick a consent box on the recipient's behalf, or put a password in logs. Provided only for a site that has independently made such a field safe for a URL.

apply_filters( 'xpac_forms_autosubmit_unsafe_fields', $found, $submission )

• $found (array) — Names of the offending fields.
• $submission (Submission) — Submission built from the query string.

Fired from:

• packages/FormsAutoSubmit/Addon.php:1376

xpac_forms_submit_response

Filter · 2 arguments · 1 call site

Filters the normalized response of an accepted or refused submission.

apply_filters( 'xpac_forms_submit_response', $response, $submission->forExternalCallback() )

• $response (array) — Normalized submit response.
• $submission (Submission) — Callback-safe submission without write-only answers.

Fired from:

• packages/FormsAutoSubmit/Addon.php:1194