hCaptcha: Clicking "Show preview" and "Show changes" triggers hCaptcha, and then publishes edit
Closed, ResolvedPublicBUG REPORT
Actions

Description

What is the problem?

While editing in the source editor, if I "Show preview" or "Show changes" it will trigger hCaptcha and potentially display a challenge I have to complete. Then, it will not actually show the preview or diff but instead publish the edit.

Steps to reproduce problem

https://test.wikipedia.org/w/index.php?title=Po%C4%8Detna_strana_moved&action=edit
Make sure you are using the WikiEditor/Source Editor
Open the browser network tab
Click either "Show preview" or "Show changes"

Expected behaviour: You shouldn't see any requests to URLs such as https://hcaptcha.wikimedia.org or https://assets-hcaptcha.wikimedia.org. You see the preview or diff as appropriate.
Observed behaviour: You do see those URLs and the edit is published.

Environment

Browser: Firefox 140. Chromium 141.
Wiki(s): https://test.wikipedia.org ConfirmEdit 1.6.0 (rECOE49231fb412f8) 16:36, 28 October 2025.
Editor: WikiEditor 0.5.4 (3cadd00) 07:45, 22 October 2025.

Screenshots

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
hcaptcha: Fix secureEnclave tests	mediawiki/extensions/ConfirmEdit	master	+1 -0
hcaptcha: Don't prevent form submissions unless making an edit	mediawiki/extensions/ConfirmEdit	wmf/1.46.0-wmf.2	+231 -81
hcaptcha: Don't prevent form submissions unless making an edit	mediawiki/extensions/ConfirmEdit	master	+231 -81

Customize query in gerrit

Related Objects

Mentioned In: T407661: hCaptcha: Disable submit button after initial button press
Mentioned Here: rEWED3cadd00af3a1: Localisation updates from https://translatewiki.net.
rECOE49231fb412f8: hCaptcha: Store risk score in cache, so that jobs can use it

Event Timeline

dom_walden created this task.Oct 29 2025, 2:12 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 29 2025, 2:12 PM

dom_walden renamed this task from hCaptcha: Clicking "Show preview" and "Show changes" triggers hCaptcha challenge to hCaptcha: Clicking "Show preview" and "Show changes" triggers hCaptcha.Oct 29 2025, 2:12 PM

dom_walden renamed this task from hCaptcha: Clicking "Show preview" and "Show changes" triggers hCaptcha to hCaptcha: Clicking "Show preview" and "Show changes" triggers hCaptcha, and then publishes edit.Oct 29 2025, 4:38 PM

dom_walden updated the task description. (Show Details)

Johannnes89 subscribed.Oct 29 2025, 4:51 PM

dom_walden added a project: WE4.2 Bot detection (WE4.2 hCaptcha editing trial).Oct 30 2025, 1:16 PM

kostajh edited projects, added Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)); removed Product Safety and Integrity.Nov 3 2025, 12:59 PM

hector.arroyo changed the task status from Open to In Progress.Nov 3 2025, 2:27 PM

hector.arroyo claimed this task.

hector.arroyo moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.

The initial requests (before clicking any button) seem due to preloading (the browser fetches the hCaptcha script as soon as you interact with the form)
Clicking on "Show preview" submits the edit
The edit is not submitted when the preview in the right panel is refreshed but only when using one of the buttons in the bottom of the page other than "Cancel"
- This suggests we are binding the hCaptcha challenge to any kind of form submission without actually checking which button was clicked
  - All buttons seem to send the same form, but each has a different name: Likely, the backend uses the button name included in the request to know if the user wants to save the edit vs other actions, and we'd need to follow the same approach when handling hCaptcha in the frontend in order to not trigger an hCaptcha workflow for the latter cases

Change #1201098 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hcaptcha: Don't prevent form submissions unless making an edit

https://gerrit.wikimedia.org/r/1201098

gerritbot added a project: Patch-For-Review.Nov 3 2025, 4:30 PM

kostajh moved this task from Backlog to In progress on the WE4.2 Bot detection (WE4.2 hCaptcha editing trial) board.Nov 4 2025, 12:56 PM

hector.arroyo moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Nov 4 2025, 5:09 PM

We've decided to follow a different approach, and tests are now failing. Moving this back to 'In Progress'.

hector.arroyo moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)) board.Nov 7 2025, 4:32 PM

OKryva-WMF edited projects, added Product Safety and Integrity (Crepes au Chocolat (Sprint Nov 10 - Nov 28)); removed Product Safety and Integrity (Sprint Mint Choc Chip Ice Cream (Oct 20 - Nov 7)).Mon, Nov 10, 12:14 PM

OKryva-WMF moved this task from Backlog to Needs review on the Product Safety and Integrity (Crepes au Chocolat (Sprint Nov 10 - Nov 28)) board.Mon, Nov 10, 12:14 PM

Change #1203803 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hcaptcha: Fix secureEnclave tests

https://gerrit.wikimedia.org/r/1203803

Change #1201098 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hcaptcha: Don't prevent form submissions unless making an edit

https://gerrit.wikimedia.org/r/1201098

Change #1203810 had a related patch set uploaded (by Kosta Harlan; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@wmf/1.46.0-wmf.2] hcaptcha: Don't prevent form submissions unless making an edit

https://gerrit.wikimedia.org/r/1203810

hector.arroyo moved this task from Needs review to Needs QA on the Product Safety and Integrity (Crepes au Chocolat (Sprint Nov 10 - Nov 28)) board.Tue, Nov 11, 1:43 PM

Change #1203810 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.46.0-wmf.2] hcaptcha: Don't prevent form submissions unless making an edit

https://gerrit.wikimedia.org/r/1203810

Mentioned in SAL (#wikimedia-operations) [2025-11-11T13:58:10Z] <kharlan@deploy2002> Started scap sync-world: Backport for [[gerrit:1203810|hcaptcha: Don't prevent form submissions unless making an edit (T408693)]]

kostajh moved this task from In progress to QA on the WE4.2 Bot detection (WE4.2 hCaptcha editing trial) board.Tue, Nov 11, 1:59 PM

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.3; 2025-11-19).Tue, Nov 11, 2:00 PM

Mentioned in SAL (#wikimedia-operations) [2025-11-11T14:02:20Z] <kharlan@deploy2002> kharlan: Backport for [[gerrit:1203810|hcaptcha: Don't prevent form submissions unless making an edit (T408693)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-11-11T14:12:00Z] <kharlan@deploy2002> Finished scap sync-world: Backport for [[gerrit:1203810|hcaptcha: Don't prevent form submissions unless making an edit (T408693)]] (duration: 13m 50s)

dom_walden mentioned this in T407661: hCaptcha: Disable submit button after initial button press.Wed, Nov 12, 11:51 AM