Page MenuHomePhabricator
Create Task
Maniphest T407339

hCaptcha: Implement hCaptcha on edits made through the MobileFrontend
Closed, ResolvedPublic
Actions

Description

Summary

  • MobileFrontend uses the API to edit
  • We need to implement the required changed to support loading hCaptcha in this context and trigger the required checks when an edit is made using the MobileFrontend.

Acceptance criteria

  • An hCaptcha captcha check is triggered when the user edits a page using the mobile frontend
  • When the captcha is shown, the edit is not made unless the user correctly solves the captcha

Related Objects
Search...

StatusSubtypeAssignedTask
 Resolved• hector.arroyoT407339 hCaptcha: Implement hCaptcha on edits made through the MobileFrontend
 Resolved• hector.arroyoT406847 hCaptcha: PoC for hCaptcha on edits made through the MobileFrontend
 Resolved• hector.arroyoT407340 hCaptcha: Provide a callback in ConfirmEdit to trigger additional actions once a captcha is solved
 Resolved• hector.arroyoT407343 hCaptcha: Allow to override the templates used for the save and captcha panels in the edit flow
 Resolved• hector.arroyoT407344 hCaptcha: Add support for hCaptcha in the MobileFrontend editor
 ResolvedDreamy_JazzT407377 hCaptcha: Create front-end JS configuration variable that indicates whether an edit to the given page would require hCaptcha completion
 ResolvedDreamy_JazzT407390 VisualEditor: Create a service to determine if a given page has VisualEditor available
 Declined• hector.arroyoT407428 MobileFrontend: Make it possible to read the value of wgMFIsSupportedEditRequest in PHP
 Resolved• hector.arroyoT407369 hCaptcha: Allow ext.confirmEdit.hCaptcha/secureEnclave.js to work when there is no form (API edits)
 Resolved• hector.arroyoT419230 hCaptcha: Move handling of ErrorWidget and ProgressIndicatorWidget to utils.js
 Resolved• hector.arroyoT419128 hCaptcha: Decouple createHCaptchaScriptTag & loadHCaptcha from the global document object
 Resolved• hector.arroyoT419126 hCaptcha: Refactor reusable code from secureEnclave.js into utils.js
 Resolved• hector.arroyoT419966 hCaptcha: Add required hooks to the MobileFrontend for supporting hCaptcha on edits
 Resolved• hector.arroyoT420574 hcaptcha: Make edits coming from the MobileFrontend use the sitekey for edits
 ResolvedMPostoronca-WMFT420903 hCaptcha: Edits on mobile which trigger addurl or AbuseFilter are failing to publish
 Resolved• hector.arroyoT423296 MobileFrontend source editor: hCaptcha privacy policy displayed unstyled
 Resolved• hector.arroyoT405753 hCaptcha: Evaluate support for MobileFrontend
 Resolved• hector.arroyoT407623 hCaptcha: Split secureEnclave.js in two files (mobile vs non-mobile interface)
 Resolved• hector.arroyoT419572 hCaptcha: Identify edits coming from the MobileFrontend
 Resolved• hector.arroyoT419832 hCaptcha: Update edit API spec to include editorinterface as a valid parameter
 Resolved• hector.arroyoT419125 hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend
 ResolvedSTranT420718 hCaptcha: Event Logging for hCaptcha-related events coming from the MobileFrontend editor
 ResolvedBUG REPORT• hector.arroyoT423878 MobileFrontend hCaptcha: If a user clicks off the visual challenge during AbuseFilter consequence save, user cannot reopen the visual challenge or proceed with their edit
 Resolved• hector.arroyoT424651 MobileFrontend's source editor allows to click on the back button while the edit is being saved

Event Timeline

• hector.arroyo created this task.Oct 15 2025, 11:10 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 15 2025, 11:10 AM
• hector.arroyo moved this task from Backlog to In progress on the Bot detection and mitigation (WE4.2 hCaptcha editing trial) board.Oct 15 2025, 11:10 AM
• hector.arroyo moved this task from Priority backlog to In progress on the Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)) board.
• hector.arroyo added a subtask: T406847: hCaptcha: PoC for hCaptcha on edits made through the MobileFrontend.
• hector.arroyo added a subtask: T407340: hCaptcha: Provide a callback in ConfirmEdit to trigger additional actions once a captcha is solved.Oct 15 2025, 11:18 AM
• hector.arroyo added a subtask: T407343: hCaptcha: Allow to override the templates used for the save and captcha panels in the edit flow.Oct 15 2025, 11:25 AM
• hector.arroyo added a subtask: T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor.Oct 15 2025, 11:29 AM
• hector.arroyo added a subtask: T405753: hCaptcha: Evaluate support for MobileFrontend.Oct 15 2025, 11:34 AM
• hector.arroyo added a subtask: T407369: hCaptcha: Allow ext.confirmEdit.hCaptcha/secureEnclave.js to work when there is no form (API edits).Oct 15 2025, 2:40 PM
• hector.arroyo changed the task status from Open to Stalled.Oct 17 2025, 9:45 AM
• hector.arroyo changed the status of subtask T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor from Open to Stalled.
• hector.arroyo added a subtask: T407623: hCaptcha: Split secureEnclave.js in two files (mobile vs non-mobile interface).Oct 17 2025, 12:23 PM
Dreamy_Jazz added projects: OKR-Work, MobileFrontend (MobileFrontend (Editor)), ConfirmEdit (CAPTCHA extension).Oct 17 2025, 1:39 PM
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)); removed: Product Safety and Integrity (Sprint Apfel Strudel (Sep 29 - Oct 17)).Oct 20 2025, 2:29 PM
OKryva-WMF moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Oct 20 2025, 2:29 PM
• hector.arroyo closed subtask T407340: hCaptcha: Provide a callback in ConfirmEdit to trigger additional actions once a captcha is solved as Resolved.Oct 22 2025, 8:31 AM
• hector.arroyo changed the task status from Stalled to In Progress.Oct 28 2025, 4:39 PM
• hector.arroyo changed the status of subtask T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor from Stalled to In Progress.
• hector.arroyo moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Oct 29 2025, 10:38 AM
• hector.arroyo closed subtask T407343: hCaptcha: Allow to override the templates used for the save and captcha panels in the edit flow as Resolved.Oct 29 2025, 4:21 PM
• hector.arroyo moved this task from Backlog to Awaiting Code Review on the ConfirmEdit (CAPTCHA extension) board.Oct 30 2025, 10:26 AM
kostajh moved this task from In progress to On hold on the Bot detection and mitigation (WE4.2 hCaptcha editing trial) board.Nov 4 2025, 12:56 PM
kostajh moved this task from Needs review to Backlog on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Nov 5 2025, 12:52 PM
• hector.arroyo edited projects, added: Product Safety and Integrity (Sprint Flower (Feb 9 - Feb 27)); removed: Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)).Feb 20 2026, 1:16 PM
• hector.arroyo moved this task from On hold to Ready on the Bot detection and mitigation (WE4.2 hCaptcha editing trial) board.
• hector.arroyo moved this task from Backlog to Ready on the Product Safety and Integrity (Sprint Flower (Feb 9 - Feb 27)) board.
• hector.arroyo moved this task from Ready to Epics in progress on the Product Safety and Integrity (Sprint Flower (Feb 9 - Feb 27)) board.Feb 20 2026, 2:42 PM
• hector.arroyo moved this task from Ready to In progress on the Bot detection and mitigation (WE4.2 hCaptcha editing trial) board.Feb 24 2026, 10:29 AM
• hector.arroyo moved this task from Backlog to Triaged on the MobileFrontend (MobileFrontend (Editor)) board.
• hector.arroyo changed the status of subtask T407623: hCaptcha: Split secureEnclave.js in two files (mobile vs non-mobile interface) from Stalled to In Progress.Feb 27 2026, 2:06 PM
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)); removed: Product Safety and Integrity (Sprint Flower (Feb 9 - Feb 27)).Mar 2 2026, 4:18 PM
OKryva-WMF moved this task from Backlog to Epics in progress on the Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)) board.
• hector.arroyo changed the status of subtask T407369: hCaptcha: Allow ext.confirmEdit.hCaptcha/secureEnclave.js to work when there is no form (API edits) from Open to In Progress.Mar 3 2026, 12:54 PM
• hector.arroyo removed a subtask: T407369: hCaptcha: Allow ext.confirmEdit.hCaptcha/secureEnclave.js to work when there is no form (API edits).Mar 6 2026, 11:55 AM
• hector.arroyo added a subtask: T419572: hCaptcha: Identify edits coming from the MobileFrontend.Mar 10 2026, 5:43 PM
• hector.arroyo added a subtask: T419125: hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend.
• hector.arroyo mentioned this in T419125: hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend.Mar 11 2026, 12:03 PM
• hector.arroyo changed the status of subtask T419125: hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend from Stalled to In Progress.
• hector.arroyo mentioned this in T419230: hCaptcha: Move handling of ErrorWidget and ProgressIndicatorWidget to utils.js.Mar 13 2026, 10:57 AM
• hector.arroyo changed the status of subtask T419125: hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend from In Progress to Stalled.Mar 16 2026, 11:45 AM
Aklapper changed the status of subtask T419125: hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend from Stalled to Open.Mar 18 2026, 10:45 AM
• hector.arroyo mentioned this in T419832: hCaptcha: Update edit API spec to include editorinterface as a valid parameter.Mar 18 2026, 1:56 PM
• hector.arroyo closed subtask T419572: hCaptcha: Identify edits coming from the MobileFrontend as Resolved.
• hector.arroyo mentioned this in T419572: hCaptcha: Identify edits coming from the MobileFrontend.
• hector.arroyo closed subtask T407623: hCaptcha: Split secureEnclave.js in two files (mobile vs non-mobile interface) as Resolved.Mar 18 2026, 1:58 PM
• hector.arroyo mentioned this in T407623: hCaptcha: Split secureEnclave.js in two files (mobile vs non-mobile interface).
• hector.arroyo mentioned this in T407369: hCaptcha: Allow ext.confirmEdit.hCaptcha/secureEnclave.js to work when there is no form (API edits).
• hector.arroyo closed subtask T419125: hCaptcha: Update mediawiki-config to enforce checks for API edits coming from the MobileFrontend as Resolved.Mar 19 2026, 12:27 PM
• hector.arroyo changed the status of subtask T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor from In Progress to Stalled.Mar 19 2026, 5:32 PM
• hector.arroyo added a subtask: T420718: hCaptcha: Event Logging for hCaptcha-related events coming from the MobileFrontend editor.Mar 20 2026, 12:24 PM
• hector.arroyo changed the status of subtask T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor from Stalled to In Progress.Mar 23 2026, 9:12 AM
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Forsythia (Mar 23 - Apr 10))); removed: Product Safety and Integrity (Sprint Crocus (Mar 2 - Mar 20)).Mar 23 2026, 3:55 PM
OKryva-WMF moved this task from Backlog to Epics in progress on the Product Safety and Integrity (Sprint Forsythia (Mar 23 - Apr 10))) board.
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)); removed: Product Safety and Integrity (Sprint Forsythia (Mar 23 - Apr 10))).Apr 13 2026, 5:11 PM
OKryva-WMF moved this task from Backlog to Epics in progress on the Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)) board.Apr 13 2026, 5:11 PM
• hector.arroyo added a subtask: T423878: MobileFrontend hCaptcha: If a user clicks off the visual challenge during AbuseFilter consequence save, user cannot reopen the visual challenge or proceed with their edit.Apr 20 2026, 3:12 PM
• hector.arroyo added a subtask: T424651: MobileFrontend's source editor allows to click on the back button while the edit is being saved.Apr 28 2026, 12:10 PM
• hector.arroyo changed the status of subtask T424651: MobileFrontend's source editor allows to click on the back button while the edit is being saved from Open to In Progress.Apr 28 2026, 12:54 PM
• hector.arroyo closed subtask T407344: hCaptcha: Add support for hCaptcha in the MobileFrontend editor as Resolved.Apr 30 2026, 2:38 PM
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)); removed: Product Safety and Integrity (Sprint Tulip (Apr 13 - May 1)).May 1 2026, 7:40 AM
OKryva-WMF moved this task from Backlog to Epics in progress on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.May 1 2026, 7:42 AM
• hector.arroyo closed subtask T423878: MobileFrontend hCaptcha: If a user clicks off the visual challenge during AbuseFilter consequence save, user cannot reopen the visual challenge or proceed with their edit as Resolved.May 6 2026, 8:46 AM
kostajh closed subtask T424651: MobileFrontend's source editor allows to click on the back button while the edit is being saved as Resolved.May 19 2026, 1:14 PM
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)); removed: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)).May 25 2026, 12:37 PM
OKryva-WMF moved this task from Backlog to Epics in progress on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.May 25 2026, 12:38 PM
• hector.arroyo moved this task from Awaiting Code Review to Feature Requests/Improvements on the ConfirmEdit (CAPTCHA extension) board.Jun 8 2026, 9:39 AM
Dreamy_Jazz closed subtask T420718: hCaptcha: Event Logging for hCaptcha-related events coming from the MobileFrontend editor as Resolved.Jun 9 2026, 4:23 PM
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Rose (Jun 15 - Jun 26)); removed: Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)).Jun 15 2026, 2:30 PM
OKryva-WMF moved this task from Backlog to Epics in progress on the Product Safety and Integrity (Sprint Rose (Jun 15 - Jun 26)) board.Jun 15 2026, 2:30 PM
kostajh closed this task as Resolved.Jun 16 2026, 11:39 AM
kostajh edited projects, added: Bot detection and mitigation (WE4.10 hCaptcha); removed: Bot detection and mitigation (WE4.2 hCaptcha editing trial).
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits