DiscussionTools hCaptcha: When user encounters AbuseFilter hCaptcha challenge no indication is shown they need to resubmit their edit
Closed, ResolvedPublic
Actions

Description

Summary

When a user completes a standard hCaptcha challenge but then has an AbuseFilter 'showcaptcha' consequence fire, the AbuseFilter version does not have an indication that the user needs to retry their edit unlike other interfaces

Background

An AbuseFilter 'showcaptcha' consequence makes the user have to use an stricter sitekey that requires the user complete a visual challenge on WMF wikis
- In other interfaces that support hCaptcha, if this appears the user is told they need to resubmit the edit to continue
  - However, DiscussionTools does not say this and just reshows the same hCaptcha widget (which for invisible mode means no visual change for the user too)
We should make DiscussionTools consistent on this and have some indication that the user should resubmit their edit

Acceptance criteria

DiscussionTools shows an additional piece of text indicating that the user should resubmit their edit to see a visual challenge, like other interfaces

Details

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced	Dreamy Jazz	mediawiki/extensions/ConfirmEdit	master	+83 -26
HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced	Dreamy Jazz	mediawiki/extensions/ConfirmEdit	wmf/1.47.0-wmf.5	+83 -26
HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced	Dreamy Jazz	mediawiki/extensions/ConfirmEdit	wmf/1.47.0-wmf.6	+83 -26
ReplyWidget: Automatically resubmit if recommended by CAPTCHA	Dreamy Jazz	mediawiki/extensions/DiscussionTools	master	+65 -37
CaptchaWidget: Recommend automatic resubmit for forceshowcaptcha	Dreamy Jazz	mediawiki/extensions/ConfirmEdit	master	+118 -8

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved	Feature	Dreamy_Jazz	T356599 hCaptcha: Implement compatibility with DiscussionTools
		Resolved		Dreamy_Jazz	T426476 DiscussionTools hCaptcha: When user encounters AbuseFilter hCaptcha challenge no indication is shown they need to resubmit their edit

Event Timeline

Dreamy_Jazz created this task.May 15 2026, 10:18 PM

Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptMay 15 2026, 10:18 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Dreamy_Jazz edited projects, added: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)); removed: Product Safety and Integrity.May 15 2026, 10:18 PM

Dreamy_Jazz moved this task from Backlog to Ready on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.

Dreamy_Jazz added a project: Bot detection and mitigation (WE4.10 hCaptcha).

Dreamy_Jazz added a parent task: T356599: hCaptcha: Implement compatibility with DiscussionTools.May 15 2026, 10:23 PM

Dreamy_Jazz updated the task description. (Show Details)

Excuse me, how does that work? If for whatever reason this resubmission is unaviodable but deterministic, why not resubmit programmatically and only prompt the user action when the challenge is ready?

Yes, we should probably do that. We do that in other editing interfaces

In T426476#11927799, @Jack_who_built_the_house wrote:

If for whatever reason this resubmission is unaviodable but deterministic, why not resubmit programmatically and only prompt the user action when the challenge is ready?

Yeah for more context:

We use the standard sitekey which should only show a visual challenge to 0.1% of users by default
If AbuseFilter asks for a user to see a CAPTCHA, we make the user see a visual challenge which uses a different sitekey (which then needs the CAPTCHA to be re-rendered)

This is handled by the mw.libs.confirmEdit.CaptchaWidget, but currently it requires the updateForCaptchaFailure method to be called with the API response and then getCaptchaDataForSubmission to be called

I can update the captcha widget code to support this, though this will require some additional changes to DiscussionTools and interfaces that use it to support this

Dreamy_Jazz claimed this task.May 18 2026, 4:52 PM

Dreamy_Jazz moved this task from Ready to In progress on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.

(Please give me a shout if anything will need to be changed in Convenient Discussions as well)

OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)); removed: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)).May 25 2026, 12:41 PM

OKryva-WMF moved this task from Backlog to In progress on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.May 25 2026, 12:42 PM

Dreamy_Jazz moved this task from In progress to Ready on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.May 28 2026, 8:52 AM

Dreamy_Jazz moved this task from Ready to In progress on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.May 28 2026, 10:58 PM

Change #1295090 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@master] [WIP] Recommend automatic resubmit for hCaptcha forceshowcaptcha

https://gerrit.wikimedia.org/r/1295090

gerritbot added a project: Patch-For-Review.May 28 2026, 10:59 PM

Change #1295459 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/DiscussionTools@master] ReplyWidget: Automatically resubmit if recommended by CAPTCHA

https://gerrit.wikimedia.org/r/1295459

Dreamy_Jazz moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.May 29 2026, 2:18 PM

Dreamy_Jazz mentioned this in T427335: hCaptcha DiscussionTools: hCaptcha token reused if AbuseFilter denies the edit.Jun 2 2026, 10:09 AM

Change #1295090 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] CaptchaWidget: Recommend automatic resubmit for forceshowcaptcha

https://gerrit.wikimedia.org/r/1295090

ReleaseTaggerBot added a project: MW-1.47-notes (1.47.0-wmf.6; 2026-06-09).Jun 8 2026, 3:00 PM

Change #1295459 merged by jenkins-bot:

[mediawiki/extensions/DiscussionTools@master] ReplyWidget: Automatically resubmit if recommended by CAPTCHA

https://gerrit.wikimedia.org/r/1295459

Maintenance_bot removed a project: Patch-For-Review.Jun 8 2026, 4:32 PM

Dreamy_Jazz moved this task from Needs review to QA in Prod on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.Jun 8 2026, 5:41 PM

@Dreamy_Jazz I am finding on testwiki that if I have triggered an AbuseFilter, if I make another reply after (within 120s?), regardless of whether it triggers an AbuseFilter, I have to submit the form twice, and the second time I am not given an indication I need to resubmit.

@dom_walden, I'm not seeing this when creating a new section or replying. Do you see any page reloads between the first reply and the second? So far I've only been able to test when there is a page reload, but I guess it could also happen where the page is not reloaded

I was able to reproduce as long as the page was not reloaded

Moving back to 'In progress' to fix that bug

So doing some debugging it turns out that this is a bug not with the DiscussionTools integration but the general hCaptcha code.

It seems that the forceshowcaptcha error is not being returned as expected, even though we are in that situation

Dreamy_Jazz mentioned this in T426481: hCaptcha DiscussionTools: If using AbuseFilter always challenge sitekey then set forcecaptcha in request to avoid two challenges.Jun 9 2026, 4:25 PM

Change #1299578 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@master] HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced

https://gerrit.wikimedia.org/r/1299578

gerritbot added a project: Patch-For-Review.Jun 9 2026, 5:04 PM

Dreamy_Jazz moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.Jun 9 2026, 5:19 PM

Change #1300734 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.6] HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced

https://gerrit.wikimedia.org/r/1300734

Change #1299578 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced

https://gerrit.wikimedia.org/r/1299578

Change #1300734 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.6] HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced

https://gerrit.wikimedia.org/r/1300734

Mentioned in SAL (#wikimedia-operations) [2026-06-11T10:20:06Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1300734|HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced (T426476)]], [[gerrit:1300727|hCaptcha: Enable for DiscussionTools on group 1 wikis (T426039)]]

Stashbot mentioned this in T426039: hCaptcha DiscussionTools: Rollout to WMF wikis.Jun 11 2026, 10:20 AM

Mentioned in SAL (#wikimedia-operations) [2026-06-11T10:22:16Z] <dreamyjazz@deploy1003> dreamyjazz: Backport for [[gerrit:1300734|HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced (T426476)]], [[gerrit:1300727|hCaptcha: Enable for DiscussionTools on group 1 wikis (T426039)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-06-11T10:31:08Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1300734|HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced (T426476)]], [[gerrit:1300727|hCaptcha: Enable for DiscussionTools on group 1 wikis (T426039)]] (duration: 11m 01s)

Maintenance_bot removed a project: Patch-For-Review.Jun 11 2026, 10:31 AM

ReleaseTaggerBot edited projects, added: MW-1.47-notes (1.47.0-wmf.7; 2026-06-16); removed: MW-1.47-notes (1.47.0-wmf.6; 2026-06-09).Jun 11 2026, 11:00 AM

Change #1300749 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.5] HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced

https://gerrit.wikimedia.org/r/1300749

gerritbot added a project: Patch-For-Review.Jun 11 2026, 11:02 AM

Change #1300749 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.5] HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced

https://gerrit.wikimedia.org/r/1300749

Mentioned in SAL (#wikimedia-operations) [2026-06-11T11:16:58Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1300749|HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced (T426476)]], [[gerrit:1300751|hCaptcha: Enable for DiscussionTools on all wikis (T426039)]]

Mentioned in SAL (#wikimedia-operations) [2026-06-11T11:19:08Z] <dreamyjazz@deploy1003> dreamyjazz: Backport for [[gerrit:1300749|HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced (T426476)]], [[gerrit:1300751|hCaptcha: Enable for DiscussionTools on all wikis (T426039)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

In T426476#11932773, @Jack_who_built_the_house wrote:

(Please give me a shout if anything will need to be changed in Convenient Discussions as well)

@Jack_who_built_the_house thanks, so the summary of the changes are:

updateForCaptchaFailure has been renamed to updateForFailure
updateForFailure should be called for any failed API response (with no CAPTCHA data provided if it's not a CAPTCHA failure)
- This is necessary so that we can generate a new hCaptcha token for each API request, as they are one-time-use tokens
updateForFailure resolves with a boolean, which when true indicates that the CaptchaWidget recommends the calling code automatically retry the edit with the updated CAPTCHA data from getCaptchaDataForSubmission
- This is so that in the case of an AbuseFilter CAPTCHA and when the wiki is using hCaptcha, the user doesn't need to reclick submit

Example uses in DiscussionTools that might be helpful to explain the changes:

https://gerrit.wikimedia.org/g/mediawiki/extensions/DiscussionTools/+/1ae0088301fcccf9657265dab2117e392415bdc3/modules/dt.ui.ReplyWidget.js#1180 - Calling updateForFailure when the error isn't CAPTCHA related
https://gerrit.wikimedia.org/g/mediawiki/extensions/DiscussionTools/+/1ae0088301fcccf9657265dab2117e392415bdc3/modules/dt.ui.ReplyWidget.js#1150 - Calling updateForFailure for a CAPTCHA error

DiscussionTools reuses the same mw.libs.confirmEdit.CaptchaWidget instance to make the automatic resubmission work, so you'll probably need to keep the same instance in Convenient-Discussions

If there is anything you want further explained, do let me know

Mentioned in SAL (#wikimedia-operations) [2026-06-11T11:25:36Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1300749|HCaptcha: Return 'forceshowcaptcha' error when CAPTCHA forced (T426476)]], [[gerrit:1300751|hCaptcha: Enable for DiscussionTools on all wikis (T426039)]] (duration: 08m 38s)