Page MenuHomePhabricator

QuestyCaptcha broken in 1.27 when using html tags in questions (please backport fix to 1.27?)
Closed, ResolvedPublic

Description

MW v1.27.3
ConfirmEdit REL1_27 branch

QuestyCaptcha is broken and outputs sanitized html even when using the examples given on Extension:QuestyCaptcha when using it to createaccount. It might be broken with edit captcha calls too. I did not verify this yet.

$arr = array (
	"A question?" => "An answer!",
	"What is this wiki's name?" => "$wgSitename",
	'Please write the magic secret, "passion", here:' => 'passion',
	'Type the code word, 567, here:' => '567',
	'Which animal? <img src="http://www.mysite.com/dog.jpg" alt="" title="" />' => 'dog',
);
foreach ( $arr as $key => $value ) {
	$wgCaptchaQuestions[] = array( 'question' => $key, 'answer' => $value );
}

Will output the image tag as: Which animal? <img src="http://www.mysite.com/dog.jpg" alt="" title="" />

Instead of the picture added with the <img> tag. Is this related to the sanitizing of messages on Special page?

Event Timeline

Looks like this was fixed but not back ported int REL1_27. Switch my branch to REL1_28 on the extension fixed this issue.

Aklapper renamed this task from QuestyCaptcha broken when using html tags in questions to QuestyCaptcha broken in 1.27 when using html tags in questions (please backport fix to 1.27?).Jun 29 2017, 9:51 AM
Aklapper added a project: MW-1.27-release.

Change 363616 had a related patch set uploaded (by Florianschmidtwelzow; owner: Ben.imbushuo):
[mediawiki/extensions/ConfirmEdit@REL1_27] Fixing unexcepted HTML escaping in QuestyCaptcha.

https://gerrit.wikimedia.org/r/363616

Florian subscribed.

As REL1_27 is an LTS release, I cherry-picked the change to the release branch. Over to Release-Engineering MW-1.27-release :)

Umherirrender triaged this task as Medium priority.

Change 363616 merged by jenkins-bot:
[mediawiki/extensions/ConfirmEdit@REL1_27] Fixing unexcepted HTML escaping in QuestyCaptcha.

https://gerrit.wikimedia.org/r/363616