Webhooks

• Updated incorrect GHSA link.

Webhook URLs that resolve to private IP addresses are now rejected, unless their hostname is listed in the allowedPrivateHosts config setting. See Sending Webhooks to Internal Services on how to do that.

• Fixed a medium-severity SSRF vulnerability. (GHSA-fr85-wg7m-6wvq)

• Fixed an error that could occur when triggering a webhook without a URL. (#103)
• Fixed a high-severity SSRF vulnerability. (GHSA-j6vc-h4j5-7chh)

Payload, header, webhook URL, and debounce key templates are now rendered in a sandboxed Twig environment, when enableTwigSandbox is enabled.

• Webhooks now requires Craft 4.17+ or 5.9+.
• Fixed a high-severity RCE vulnerability. (GHSA-8wg7-wm29-2rvg)

• Fixed a PHP error that could occur if a webhook header was null. (#97)

• Added Craft 5 compatibility.
• Fixed a bug where request timestamps in the Activity section weren’t using the system time zone. (#78)

Fixed

• Fixed a potential SSRF vulnerability.

Fixed

• Fixed a bug where the FirstSave and ProvisionalDraft filters would not respect negation. (#74)

Fixed

• Fixed a bug where you couldn’t add custom headers when defining a webhook. (#73)

Fixed

• Fixed a Twig error when accessing the activity page. (#71)

Fixed

• Fixed PHP error. (#70)

Added

• Added Craft 4 compatibility.

Changed

• The webhookManager component can now be configured via craft\services\Plugins::$pluginConfigs.