Edit summary reminder preference conflicts with CAPTCHA extensions


Author: kevinlamontagne


  • Check "Prompt me when entering a blank edit summary" in user preferences.
  • Edit a page including external links, without putting a summary.
  • fill out the CAPTCHA
  • "Reminder: You have not provided an edit summary. If you click Save again, your edit will be saved without one."; Click save.
  • Get another CAPTCHA to fill out. You're now caught in a loop until you put an edit summary.

Version: unspecified
Severity: normal
See Also:

bzimport added a subscriber: Unknown Object (MLST).
bzimport set Reference to bz10729.
bzimport created this task.Via LegacyJul 28 2007, 6:27 AM
bzimport added a comment.Via ConduitJul 28 2007, 6:28 AM

kevinlamontagne wrote:

I forgot to say that I tested this on the english Wikipedia

bzimport added a comment.Via ConduitJul 28 2007, 7:07 AM

robchur wrote:

I'm strongly toying with the idea of moving this preference to use a bit of JavaScript, rather than fiddling about checking values on POST; the likely audience for the feature most probably have it enabled, so I doubt anyone's going to lose out.

Umherirrender added a comment.Via ConduitMar 27 2009, 10:13 PM
  • Bug 18126 has been marked as a duplicate of this bug. ***
Tobias added a comment.Via ConduitMar 28 2009, 7:06 AM

Full support, Rob.
The current user interface is extremely confusing. You click "save page", get a warning about a "missing edit summary" on top of the page, while the edit summary line is hidden somewhere below the edit field, and it is difficult to spot, as it is not highlighted at all.
A small piece of Javascript code should provide more usability. For example, as long as the summary is not filled out, highlight it in red and give a warning message.

Umherirrender added a comment.Via ConduitJul 3 2009, 3:31 PM

Extension ConfirmEdit has to pass wpIgnoreBlankSummary.

Description in EditPage.php:

  1. If a blank edit summary was previously provided, and the appropriate
  2. user preference is active, pass a hidden tag as wpIgnoreBlankSummary. This will stop the
  3. user being bounced back more than once in the event that a summary
  4. is not required.
Tobias added a comment.Via ConduitJul 3 2009, 7:43 PM

checks for $editPage->allowBlankSummary

fixed in the attached patch

attachment bug.patch ignored as obsolete

Tobias added a comment.Via ConduitAug 2 2009, 3:32 PM

Done in r54215

Nikerabbit added a comment.Via ConduitAug 3 2009, 9:35 AM

Reverted in r54260, breaks captcha.

Tobias added a comment.Via ConduitAug 3 2009, 1:20 PM

nikerabbit is right, an attacker could just add wpIgnoreBlankSummary to the source code and circumvent the captcha.
A way to fix this would be to provide a token after the captcha has been solved. However, the usability of forcesummary is already so bad that a complete rewrite or alternatives (Javascript for example) are perhaps more appropriate.

Umherirrender added a comment.Via ConduitApr 17 2010, 10:05 PM

Created attachment 7302
reassign wpCaptchaId and wpIgnoreBlankSummary

The patch reassign the wpIgnoreBlankSummary field so the forceeditsummary is not shown twice. It also reassign the wpCaptchaId so the captcha is not shown twice.

Maybe it is a bad idea to reuse the old value, then let storeCaptcha() create a new one.

attachment bug10729.patch ignored as obsolete

Umherirrender added a comment.Via ConduitMay 5 2012, 2:54 PM

Comment on attachment 6296
checks for $editPage->allowBlankSummary

This patch breaks captcha, see comment 8, marking obsolete

Umherirrender added a comment.Via ConduitMay 5 2012, 2:56 PM

I am not sure, if my patch was the best way to do it. Marking as obsolete, maybe a other developer find a good way.

Matanya added a comment.Via ConduitJul 26 2012, 9:04 PM

This needs a new design.

Florian added a subscriber: Florian.Via WebJan 14 2015, 10:57 PM

A possible solution would be to save a key in memcached (e.g. captcha:solved:{edittoken}) with the value, if the captcha was successfully solved or not. If yes, the user doesn't need to solve the captcha again and we can set wpIgnoreBlankSummary. After the edit was successful, the key can be removed.

Any ideas/opinions?

Umherirrender removed a subscriber: Umherirrender.Via WebFeb 24 2015, 7:29 PM

Add Comment