AbuseFilter 'showcaptcha' consequence is broken
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	XXBlackburnXx
	Oct 21 2025, 8:24 PM

Description

Steps to replicate the issue:

Create a test abuse filter with the 'showcaptcha' consequence enabled
Trigger that filter

What happens?:

No CAPTCHA is being shown.

What should have happened instead?:

A CAPTCHA should've been shown.

Examples::

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
ConfirmEditHandlerTest: Re-apply test	mediawiki/extensions/AbuseFilter	master	+1 -2
CaptchaConsequence: Re-use existing SimpleCaptcha instance	mediawiki/extensions/ConfirmEdit	master	+55 -18
ConfirmEditHandler: Set CaptchaTrigger to 'edit' or 'create'	mediawiki/extensions/AbuseFilter	master	+20 -6

Customize query in gerrit

Event Timeline

XXBlackburnXx created this task.Oct 21 2025, 8:24 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 21 2025, 8:24 PM

XXBlackburnXx updated the task description. (Show Details)Oct 21 2025, 8:32 PM

Johannnes89 subscribed.Oct 22 2025, 7:40 AM

I've confirmed this myself. No captcha was shown.

kostajh claimed this task.Oct 22 2025, 11:26 AM

Change #1198028 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@master] CaptchaConsequence: Re-use existing SimpleCaptcha instance

https://gerrit.wikimedia.org/r/1198028

gerritbot added a project: Patch-For-Review.Oct 22 2025, 11:33 AM

kostajh edited projects, added Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)); removed Product Safety and Integrity.Oct 22 2025, 11:33 AM

Change #1198038 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/AbuseFilter@master] ConfirmEditHandler: Set CaptchaTrigger to 'edit'

https://gerrit.wikimedia.org/r/1198038

kostajh moved this task from Backlog to Needs review on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Oct 22 2025, 12:41 PM

Change #1198058 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/AbuseFilter@master] ConfirmEditHandlerTest: Re-apply test

https://gerrit.wikimedia.org/r/1198058

Change #1198038 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] ConfirmEditHandler: Set CaptchaTrigger to 'edit' or 'create'

https://gerrit.wikimedia.org/r/1198038

Change #1198028 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] CaptchaConsequence: Re-use existing SimpleCaptcha instance

https://gerrit.wikimedia.org/r/1198028

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.25; 2025-10-28).Oct 23 2025, 1:00 PM

OKryva-WMF moved this task from Needs review to Needs QA on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Oct 28 2025, 12:59 PM

@kostajh Should this be working on testwiki? I tried it and, although it is being logged, I don't actually see any captcha challenges.

EDIT: nevermind, I just noticed my user has skipcaptcha right.

I was able to create a new page in the Talk namespace (new users cannot create main pages on enwiki beta). Apparently I triggered the AF rule, but I did not actually see the captcha. My user did not have skipcaptcha.

In T407907#11340668, @dom_walden wrote:

I was able to create a new page in the Talk namespace (new users cannot create main pages on enwiki beta). Apparently I triggered the AF rule, but I did not actually see the captcha. My user did not have skipcaptcha.

I don't know about beta cluster, but it works fine on test.wikidata.org with this filter https://test.wikidata.org/wiki/Special:AbuseFilter/30

In T407907#11343499, @kostajh wrote:

In T407907#11340668, @dom_walden wrote:

I was able to create a new page in the Talk namespace (new users cannot create main pages on enwiki beta). Apparently I triggered the AF rule, but I did not actually see the captcha. My user did not have skipcaptcha.

I don't know about beta cluster, but it works fine on test.wikidata.org with this filter https://test.wikidata.org/wiki/Special:AbuseFilter/30

I have seen various cases on testwiki and testwikidata where I don't see a captcha when creating a new page in other namespaces. I do see the captcha when editing those same pages after I have created them.

Change #1198058 merged by jenkins-bot:

[mediawiki/extensions/AbuseFilter@master] ConfirmEditHandlerTest: Re-apply test

https://gerrit.wikimedia.org/r/1198058

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.2; 2025-11-12).Nov 5 2025, 1:00 PM

Maintenance_bot removed a project: Patch-For-Review.Nov 5 2025, 1:31 PM

I also don't see a captcha when I trigger a filter during the move, delete or upload actions. I had to test these locally because non-autoconfirmed users cannot normally do these actions.

I was prevented from doing an edit via ContentTranslation, but I was not shown a captcha to fill in, I just saw an error Unsupported captcha type encountered.