Problem/Motivation

The form concatenates scheme/host with a fixed path. A Drupal site mounted at /cms is shown /api/webhooks/postmark instead of /cms/api/webhooks/postmark, which can send dashboard traffic to the wrong route.

Evidence and scope

Reviewed 1.0.0-alpha1, source commit 02fd9d36af5237e712cecb7155d79725f7824880. Location: src/Form/PostmarkWebhookSettingsForm.php:33.

Code-confirmed omission of the request base path; a browser deployment under a subdirectory was not run.

Proposed resolution

Generate an absolute URL from the webhook route. Honor Drupal trusted proxy/base-path behavior. If an external webhook hostname needs an override, keep it explicit and validate it; never include credentials in the displayed URL.

Acceptance criteria

Functional coverage for root, subdirectory and trusted reverse-proxy installations. Verify escaping and confirm settings secret never appears in page source.

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Assigned: Unassigned » jmcerda
Status: Active » Needs review

The displayed webhook URL now comes from the receive route. Routing-context tests cover root, subdirectory and trusted proxy prefixes. Real HTTP tests cover settings permissions, credential-free page source, Basic Auth, method restrictions and retries; the full suite passes on Drupal 10 and 11. CI now starts and verifies its disposable HTTP server. Actual subdirectory browser deployment remains an integration follow-up under #3621137; the current prefix tests exercise Drupal routing context. Integration and release are pending.

  • jmcerda committed 14de4121 on 1.x 
    Issue #3621125: Verify test server readiness and restore proxy context

  • jmcerda committed b03d689c on 1.x 
    Issue #3621125: Generate routed endpoint URLs and test HTTP access
jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Needs review » Fixed

Integrated into the 1.x development branch and included in 1.0.0-alpha2. The release tag and branch are mirrored to Drupalcode. The six-job Drupal 10/11 and Mailer Plus integration matrix passes. See the release notes for database updates and retained-history limitations. This records module publication; site deployment is a separate operation.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.