Page MenuHomePhabricator

hCaptcha: Automatically resubmit "publish changes" when AbuseFilter's "showcaptcha" trigger is invoked
Open, In Progress, Needs TriagePublic

Description

Summary

As seen in T411927: Temporary account adding URL on first Publish attempt gets hCaptcha request, but no popup., needing to resubmit the form is not intuitive. When AbuseFilter's "showcaptcha" trigger is invoked, we should automatically resubmit the form via a few lines of JavaScript. We'll need to be careful about how we do this, though, since resubmission should only happen on the first page reload and not subsequent ones.

Acceptance criteria

  • The wikitext editor form is resubmitted automatically the first time that the "showcaptcha" trigger is invoked after a page reload

Event Timeline

Automatically resubmitting any form sounds like a hack at best and a recipe for disaster at worst. Can the captcha not be returned immediately?

hector.arroyo changed the task status from Open to In Progress.Dec 9 2025, 10:02 AM
hector.arroyo claimed this task.

Automatically resubmitting any form sounds like a hack at best and a recipe for disaster at worst. Can the captcha not be returned immediately?

It cannot. The user submits the form using a SiteKey used with 99.9% passive mode, and then AbuseFilter decides that the user needs to be shown a CAPTCHA. This necessitates a page reload, where the user needs to resubmit with the more restrictive SiteKey. (For VisualEditor and other API based editing flows, this will be a less clunky experience.)

Change #1216834 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hcaptcha: Make page reloads caused by AbuseFlilters to trigger a captcha immediately

https://gerrit.wikimedia.org/r/1216834

Change #1216834 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hcaptcha: Trigger a workflow if an AbuseFilter triggered a page reload

https://gerrit.wikimedia.org/r/1216834