REW-2816 - changes to docs to reflect new pingback url SSRF ruling

source/includes/api/orders.md

@@ -296,7 +296,7 @@ order\[recipient_email\] | String | Required for a product where the product `de
 order\[recipient_phone\] | String | Optional - string representation of an alternate phone number to be provided as the recipient of this product
 order\[delivery_instructions\] | String | Optional - allows for the provision of extra instructions for the delivery of this order such as "Please knock, the door bell is not working"
 order\[remote_order\] | String | Optional - this can be used to record the ordering systems own unique id for this order. Some systems will create an order locally before attempting to push the order over the API to GPS. This field can be used to store this id value for later cross referencing.
-order\[pingback_url\] | String | Optional - if provided, must be a valid URL (with scheme i.e. http:// or https://) that identifies this order locally on the ordering system. If an order is updated by GPS, we will make a simple get request to this url. This is a signal that an update has occured and the ordering system should fetch the order by id (GPS order.id). The URL provided should not require any kind of authentication and as such should also not 'leak' any information.
+order\[pingback_url\] | String | Optional - if provided, must be a valid URL (with https://) that identifies this order locally on the ordering system. If an order is updated by GPS, we will make a simple get request to this url. This is a signal that an update has occured and the ordering system should fetch the order by id (GPS order.id). The URL provided should not require any kind of authentication and as such should also not 'leak' any information and should NOT return a redirect.
 line_items\[0\]\[line_item\]\[name\] | String | Required - this is the name of the product being ordered
 line_items\[0\]\[line_item\]\[sku\] | String | Required - this is the SKU of the product being order. If ordering a variant of a product, ALWAYS provide the variant SKU
 line_items\[0\]\[line_item\]\[quantity\] | Integer | Required - the number of this product to deliver