Steps to replicate the issue (include links if applicable):
- Log out of your account/be in incognito mode
- Open the 2010 wikieditor for a draft page like https://en.wikipedia.org/w/index.php?title=Draft:Cross-site_leaks&action=submit
- Paste in the following content:
{{Cite web
| last = Jensen
| first = Nathan D.
| title = General Alexandre-Louis-Robert Girardin d'Ermenonville (1776-1855)
| url = https://www.frenchempire.net/biographies/girardin/
| website = frenchempire.net
| access-date = 31 October 2025
}}- Press "Publish page"
What happens?:
The page reloads with no notice, peeking at logstash tells me: "ConfirmEdit: new captcha session; 1x url trigger by '<my IP>' at [[Draft:Cross-site leaks]]: https://www.frenchempire.net/biographies/girardin/" but no CAPTCHA is shown to me
What should have happened instead?:
The page should show a CAPTCHA or the edit should have been published
Originally reported by Qcne in the NPP discord server in this thread