Webhooks

5 hooks fired by Webhooks: 5 filters and 0 actions across 6 call sites. 4 of the 6 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.

xpac-forms-after-settings-modal-content

Filter · 3 arguments · 1 call site

Content appended inside a settings panel's item modal.

applyFilters( 'xpac-forms-after-settings-modal-content', [], { value: options, onChange: onUpdate, }, 'xpac-webhooks' )

Fired from:

• assets/packages/webhooks/Components/Modal.js:534

xpac_forms_webhooks_field_value

Filter · 7 arguments · 1 call site

Filters one submitted field value on its way into the webhook payload.

File fields reach this after every attachment has resolved to a public URL. The field name, outgoing key and Submission identify the value without requiring a callback to reverse-map the block. Literals and omitted answers do not reach the filter.

apply_filters( 'xpac_forms_webhooks_field_value', $field_value, $field_type, $data, $blocks, $field_name, $payload_key, $submission )

• $field_value (mixed) — Submitted value, or a public URL array for files.
• $field_type (string) — Forms field type.
• $data (array) — Callback-safe submitted data map.
• $blocks (array) — Whole field-block map.
• $field_name (string) — Form field name.
• $payload_key (string) — Outgoing payload key.
• $submission (Submission) — Callback-safe delivery clone.

Fired from:

• packages/Webhooks/Addon.php:928

xpac_forms_webhooks_request_body

Filter · 3 arguments · 1 call site

Filters the complete webhook request body before it is encoded.

Return an array or a WP_Error. The latter records a permanent delivery failure without sending a partial payload.

apply_filters( 'xpac_forms_webhooks_request_body', $webhook_data, $config, $submission )

• $webhook_data (array) — Complete payload.
• $config (array) — Stored webhook body settings.
• $submission (Submission) — Callback-safe delivery clone.

Fired from:

• packages/Webhooks/Addon.php:970

xpac_webhooks_allow_unsafe_url

Filter · 2 arguments · 2 call sites

Filters whether a webhook may be sent to an address WordPress refuses by default.

Private and reserved ranges, loopback, and every port outside 80, 443 and 8080 are refused. That is the right default — this endpoint is configured by anyone who can edit a form, which map_meta_cap resolves to edit_others_posts plus edit_published_posts, so an Editor holds it, and the request's URL, method, body and headers all come from them.

Consulted twice — here, and again in send(), where returning true is what drops the request from wp_safe_remote_request() to wp_remote_request(). Allowing it in one place only would pass this check and then fail inside core as a transport error, which classifies transient and burns all five retries on a request that can never succeed.

So a callback should test the host it is handed rather than returning true outright: true disables core's protections for that request completely, including the DNS-time check that is the only thing standing between this and a name repointed at loopback. Core's own http_allowed_safe_ports is the narrower lever when a port is the only problem.

apply_filters( 'xpac_webhooks_allow_unsafe_url', false, $request['url'] )
apply_filters( 'xpac_webhooks_allow_unsafe_url', false, $url )

• $allowed (bool) — Whether to send anyway. Default false.
• $url (string) — The configured URL.

Fired from:

• packages/Webhooks/Addon.php:386
• packages/Webhooks/Addon.php:663

xpac_webhooks_request_timeout

Filter · 1 argument · 1 call site

apply_filters( 'xpac_webhooks_request_timeout', 10 )

Fired from:

• packages/Webhooks/Addon.php:383