FormsAutoSubmit

7 hooks fired by FormsAutoSubmit: 6 filters and 1 actions across 7 call sites. 5 of the 7 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.

xpac_forms_autosubmit_allow_legacy_form_signature

Filter · 4 arguments · 1 call site

Filters whether legacy signatures that cover only form id and expiry may be accepted.

This compatibility path is deliberately disabled. Enabling it makes every answer in an intercepted link mutable and permits expiry zero, exactly the unsafe legacy contract. Use only while replacing old links with buildSignedUrl() output.

apply_filters( 'xpac_forms_autosubmit_allow_legacy_form_signature', false, $form, $canonical, $expiry )

• $allow (bool) — Whether the unsafe legacy signature is accepted.
• $form (WP_Post) — Form being submitted.
• $canonical (array) — Submitted values not covered by the legacy signature.
• $expiry (int) — Submitted expiry; zero means no expiry for legacy links.

Fired from:

• packages/FormsAutoSubmit/Addon.php:470

xpac_forms_autosubmit_link_ttl

Filter · 3 arguments · 1 call site

Filters the lifetime of a concrete auto-submit link.

The result is always clamped to five minutes through seven days. This is a validity window only. Opening the link answers a page whose script sends it, so a scanner that fetches the link without running that script submits nothing, and one that runs it does.

apply_filters( 'xpac_forms_autosubmit_link_ttl', self::DEFAULT_LINK_TTL, $form, $canonical )

• $ttl (int) — Requested lifetime in seconds. Default one hour.
• $form (WP_Post) — Form the link will submit.
• $canonical (array) — Exact normalized values covered by the signature.

Fired from:

• packages/FormsAutoSubmit/Addon.php:342

xpac_forms_autosubmit_pre_submit

Action · 1 argument · 1 call site

Fires immediately before a link-triggered submission is processed.

Reached once on the link's first processing request, from a "template_include" callback, and only after the request has cleared every gate: the method is POST, sent by the page the link's GET answered, the "autosubmit" action and a "form_id" resolved to a published form post, the exact value-bound signature and expiry passed, a Submission was constructed without throwing, that form's own Auto Submit toggle is on, and the form neither requires a signed-in visitor nor runs an account or content action. It runs as a signed-out visitor, whoever opened the link. Submissions made through Forms' REST route never reach it, so this is the only place to treat a submission that arrived as a URL differently from one a visitor typed. A durable completed-mutation recovery skips this hook because its accepted phase must not be offered to extensions a second time.

The Submission is already initialised, so the two setters that guard on that flag — setData() and setRules(), Forms/core/base/Submission.php:352-359 and :237-244 — return without doing anything. A callback can read the data and can register filters on anything fired later inside submit(), but cannot replace either. It also runs before this plugin adds its own "xpac_forms_enable_verification" callback, so one added here is consulted first.

The return value is ignored. To stop a submission from here, redirect or exit directly; a callback added to "xpac_forms_pre_submit_callbacks" is the supported way to refuse one and have the reason reported to the visitor.

do_action( 'xpac_forms_autosubmit_pre_submit', $submission )

• $submission (Submission) — The submission built from the request's query parameters, before validation has run.

Fired from:

• packages/FormsAutoSubmit/Addon.php:1076

xpac_forms_autosubmit_unsafe_fields

Filter · 2 arguments · 1 call site

Filters the fields an auto-submit link is refused for carrying.

Returning an empty array restores the behaviour where a link could satisfy a required file field with arbitrary text, tick a consent box on the recipient's behalf, or put a password in logs. Provided only for a site that has independently made such a field safe for a URL.

apply_filters( 'xpac_forms_autosubmit_unsafe_fields', $found, $submission )

• $found (array) — Names of the offending fields.
• $submission (Submission) — Submission built from the query string.

Fired from:

• packages/FormsAutoSubmit/Addon.php:1493

xpac_forms_form_requires_login

Filter · 2 arguments · 1 call site

apply_filters( 'xpac_forms_form_requires_login', ! empty($login['status']), $form )

Fired from:

• packages/FormsAutoSubmit/Addon.php:1593

xpac_forms_pre_submit_callbacks

Filter · 2 arguments · 1 call site

apply_filters( 'xpac_forms_pre_submit_callbacks', [], $submission->forExternalCallback() )

Fired from:

• packages/FormsAutoSubmit/Addon.php:1514

xpac_forms_submit_response

Filter · 2 arguments · 1 call site

Filters the normalized response of an accepted or refused submission.

apply_filters( 'xpac_forms_submit_response', $response, $submission->forExternalCallback() )

• $response (array) — Normalized submit response.
• $submission (Submission) — Callback-safe submission without write-only answers.

Fired from:

• packages/FormsAutoSubmit/Addon.php:1216