There are situations where it would make sense to require temporary account users to complete a CAPTCHA for future edit attempts after initial edit creation. For example:
- the user's first edit was reverted
- the user's IP is known to iPoid-Service
- etc
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| In Progress | Niharika | T324492 Temporary accounts - MVP | |||
| Open | kostajh | T357776 [Epic] Mitigate abilities to abuse temporary accounts | |||
| Resolved | kostajh | T357779 Provide ability to require temporary account users to complete a CAPTCHA in certain circumstances |
Event Timeline
Comment Actions
I think this is something that can solved via T20110: Define AbuseFilter consequence to display a CAPTCHA, so I will mark it as stalled until we have fully rolled out the showcaptcha consequence.
Comment Actions
T20110: Define AbuseFilter consequence to display a CAPTCHA is deployed everywhere, and one can use user_type == 'temp' in AbuseFilter variables to require CAPTCHA display to temporary accounts. I've implemented a test for this with this filter https://test.wikipedia.org/wiki/Special:AbuseFilter/history/272/item/1830 and filed T373422: jQuery.Deferred exception: this.setSaveErrorMessage is not a function for an edge case issue noted with DiscussionTools.