Maniphest T356599

hCaptcha: Implement compatibility with DiscussionTools
Closed, ResolvedPublicFeature
Actions

Description

Steps to replicate the issue (include links if applicable):

Enable ConfirmEdit and choose the "hCaptcha" option
Be logged in
Attempt to use the "Reply" function in DiscussionTools

What happens?:

appears

What should have happened instead?:
hCaptcha's UI should appear as it does on pages such as Special:CreateAccount

Software version (skip for WMF-hosted wikis like Wikipedia):

Product Version
MediaWiki 1.40.2 (13bc5ff)
22:43, 30 January 2024
PHP 8.2.7 (fpm-fcgi)

Other information (browser name/version, screenshots, etc.):

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved	Feature	Dreamy_Jazz	T356599 hCaptcha: Implement compatibility with DiscussionTools
Resolved		Dreamy_Jazz	T422878 hCaptcha: Add support to mw.libs.confirmEdit.CaptchaWidget
Resolved		Dreamy_Jazz	T425955 DiscussionTools hCaptcha: Show hCaptcha widget before first reply attempt
Resolved		Dreamy_Jazz	T426229 Drop ext.confirmEdit.CaptchaInputWidget module and associated code
Resolved		Dreamy_Jazz	T426227 Remove all remaining uses of mw.libs.confirmEdit.CaptchaInputWidget
Resolved		Jack_who_built_the_house	T424598 Update ConvenientDiscussions to use mw.libs.confirmEdit.CaptchaWidget instead of mw.libs.confirmEdit.CaptchaInputWidget
Resolved		Dreamy_Jazz	T424597 Make use of the mw.libs.confirmEdit.CaptchaWidget in DiscussionTools instead of CaptchaInputWidget
Resolved		Dreamy_Jazz	T422913 Rework mw.libs.confirmEdit.CaptchaInputWidget to not always require an input field
Resolved		Dreamy_Jazz	T426476 DiscussionTools hCaptcha: When user encounters AbuseFilter hCaptcha challenge no indication is shown they need to resubmit their edit

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Restricted Application added a subscriber: • Aklapper. · View Herald TranscriptFeb 4 2024, 5:40 PM

Paladox subscribed.Feb 4 2024, 7:23 PM

Pppery renamed this task from DiscussionTool is incompatible with hCaptcha (and likely ReCaptcha) to DiscussionTools is incompatible with hCaptcha (and likely ReCaptcha).Feb 4 2024, 9:37 PM

Pppery updated the task description. (Show Details)

Bugreporter added a project: ConfirmEdit (CAPTCHA extension).Feb 5 2024, 3:20 AM

~~Note for Editing Team: this does not affect WMF wikis~~

kostajh added a parent task: T250227: Investigate and evaluate hCaptcha to replace Wikimedia's Fancy Captcha.Feb 16 2024, 12:51 PM

In T356599#9512522, @Esanders wrote:

Note for Editing Team: this does not affect WMF wikis

And it never should affect Wikimedia production, as the current ConfirmEdit integration with hCaptcha is far too basic to satisfy all of the technical concerns outlined in T250227 and elsewhere.

BlankEclair subscribed.Jun 20 2024, 6:46 AM

I believe the bug currently lies in DiscussionTools.

For VisualEditor, ConfirmEdit handles displaying the captcha. ve.init.mw.CaptchaSaveErrorHandler.js handles SimpleCaptcha and QuestyCaptcha (by using ext.confirmEdit.CaptchaInputWidget.js, a multi-purpose CAPTCHA text box), and ve.init.mw.HCaptchaSaveErrorHandler.js handles hCaptcha. All save error handlers are tested by VisualEditor as the modules register a hook with VE, and one is used based on the return value of matchFunction.

In contrast, DiscussionTools handles CAPTCHAs by only using ext.confirmEdit.CaptchaInputWidget (see dt.ui.ReplyWidget.js line 1085). This input widget only supports textboxes, while hCaptcha (and probably reCaptcha) uses an iframe.

A workaround would be to hardcode exceptions for hCaptcha and reCaptcha in DiscussionTools, and use their hooks somehow. A proper fix would be to either add hooks into DiscussionTools, or to reuse VisualEditor's.

OOI, does this actually prevent using DiscussionTools with hCaptcha (or similar) enabled? Or does it just present an ineffective captcha (that can't be solved, and therefore doesn't prevent stuff that it maybe should've)...

DiscussionTools can't properly display the captcha if it is given one, but otherwise it should work if there is no captcha presented to it. (Un)fortunately, there is no captcha bypass when using DT.

Reedy mentioned this in T374770: Non-autoconfirmed users get no CAPTCHA and cannot save external links with DiscussionTools new topic tool.Oct 24 2024, 12:58 AM

Reedy merged a task: T327054: Recaptcha does not work with DiscussionTools.Oct 24 2024, 1:11 AM

Reedy added a subscriber: Ryoya3.

Reedy moved this task from Backlog to Bugs on the ConfirmEdit (CAPTCHA extension) board.Oct 24 2024, 1:21 AM

Reedy removed a parent task: T250227: Investigate and evaluate hCaptcha to replace Wikimedia's Fancy Captcha.Oct 24 2024, 1:25 AM

• acooper added a project: Bot detection and mitigation.Dec 13 2024, 2:31 PM

Now we're working on getting into hcaptcha into production for a trial, this bug is becoming more of a blocker because we'd really like to test it on edits. We aren't going to be ready for another quarter but if this was fixed we could do some more interesting experiments to show how well hcaptcha can protect against spam edits.

• acooper triaged this task as Medium priority.Jan 31 2025, 3:37 PM

@Esanders just talking about this with Reedy, we think the fix might be similar to how VisualEditor fixed it but we don't really have the javascript expertise to figure it out. Is there any chance we could get this fixed early Q4?

Reedy added a subscriber: ppelberg.Jan 31 2025, 4:01 PM

matmarex subscribed.Mar 14 2025, 3:03 PM

Alex44019 subscribed.Apr 23 2025, 9:39 AM

I also just encountered this one :(

In T356599#10844944, @Addshore wrote:

I also just encountered this one :(

patch-welcome

Macro goat-for-it:

lihaohong subscribed.Jul 23 2025, 7:29 PM

AllUsernamesArePicked subscribed.Aug 8 2025, 10:19 PM

kostajh renamed this task from DiscussionTools is incompatible with hCaptcha (and likely ReCaptcha) to hCaptcha: Implement compatibility with DiscussionTools.Sep 25 2025, 1:43 PM

kostajh edited projects, added: Bot detection and mitigation (WE4.2 hCaptcha editing trial), Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26)); removed: Bot detection and mitigation.

kostajh removed a subscriber: • acooper.

kostajh edited projects, added: Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)); removed: Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26)).Sep 29 2025, 7:58 AM

kostajh set the point value for this task to 0.75.Sep 30 2025, 11:48 AM