Page MenuHomePhabricator

ConfirmEdit: Refactor captcha implementations to not use sub-extensions
Open, Needs TriagePublic0.5 Estimated Story Points

Description

Summary

The ConfirmEdit (CAPTCHA extension) extension allows loading of a captcha implementation via wfLoadExtension. This makes it hard to load more than one captcha implementation for different endpoints. These sub-extensions should be removed and replaced with more flexible configuration to enable implementations.

Background

  • ConfirmEdit (CAPTCHA extension) has several captcha implementations
    • The code for these implementations often uses shared base classes (such as SimpleCaptcha)
    • The subextensions are small and only contain the i8n files with an extension.json file
  • Loading more than one captcha has been hard and has caused issues such as T394814
    • In T394814, there were comments made that "I would be keen to unwind the concept of this being multiple extensions in a trench coat" (T394814#10841508) and "... treat the selected backend as a config var / pluggable service class, rather than a separate extension with separate hooks each" (T394814#10841481)
  • In T394804 there is a request to make it possible to use different captcha implementations for different actions
    • Doing this means that we need to load more than one ConfirmEdit (CAPTCHA extension) sub-extension on one wiki, which has been historically not supported
    • Removing the sub-extensions to make the support for T394804 explicit would be useful and also helps avoid issues caused by extensions being loaded at the same time.

Technical notes

  • We may need a period of deprecation where it is still supported to use the sub-extension loading method but it raises deprecation warnings
    • We can probably still do that, but essentially make the extension.json a wrapper at most

Acceptance criteria

Event Timeline

This has also caused the QUnit tests we defined for hCaptcha to not be run in CI, and because of that they now fail

@Dreamy_Jazz and I discussed this, and think we should try to move it forward. Let's see how far we can get with 4 hours of work on it. If we uncover additional problems, we can reconsider.

kostajh set the point value for this task to 0.5.Oct 8 2025, 10:21 AM

Change #1194584 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@master] [WIP] Merge hCaptcha sub-extension into ConfirmEdit main extension

https://gerrit.wikimedia.org/r/1194584

Change #1194589 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@master] [WIP] Define $wgLoadedCaptchas

https://gerrit.wikimedia.org/r/1194589

Change #1194590 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@master] [WIP] Move hCaptcha config to main ConfirmEdit extension

https://gerrit.wikimedia.org/r/1194590

Change #1194591 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@master] [WIP] Move hCaptcha i18n to main ConfirmEdit extension

https://gerrit.wikimedia.org/r/1194591

Change #1194692 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[translatewiki@master] ConfirmEdit: Reflect change in i18n file structure

https://gerrit.wikimedia.org/r/1194692

Change #1194590 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] Move hCaptcha config to main ConfirmEdit extension

https://gerrit.wikimedia.org/r/1194590

Change #1194591 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] Move hCaptcha i18n to main ConfirmEdit extension

https://gerrit.wikimedia.org/r/1194591

Change #1194692 merged by jenkins-bot:

[translatewiki@master] ConfirmEdit: Reflect change in i18n file structure

https://gerrit.wikimedia.org/r/1194692

Change #1194589 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] Create LoadedCaptchasProvider service

https://gerrit.wikimedia.org/r/1194589

Leaving the rest till we have more time, so this task should remain open

Change #1194584 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] Merge hCaptcha ResourceLoader modules into main extension

https://gerrit.wikimedia.org/r/1194584

We've done what we needed for the editing trial, so I am untagging that project for now.

Change #1196504 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/VisualEditor@master] [WIP] Add VisualEditorAvailabilityLookup service

https://gerrit.wikimedia.org/r/1196504

Change #1196509 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/VisualEditor@master] Add VisualEditorAvailabilityLookup service

https://gerrit.wikimedia.org/r/1196509

Change #1196905 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/VisualEditor@master] Hard deprecate soft-deprecated ApiVisualEditor methods

https://gerrit.wikimedia.org/r/1196905

We did this for hCaptcha, other sub-extensions are out of scope for Bot detection and mitigation (WE4.10 hCaptcha)