Page MenuHomePhabricator

VisualEditor: destroy hCaptcha widget when server returns FancyCaptcha challenge
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Not currently reproducible ? the server-side cause was fixed in T426751
  • Historically: open VisualEditor on a wiki with hCaptcha active, trigger AbuseFilter, and have the save request hit a pod serving FancyCaptcha instead of hCaptcha

What happens?:

When the server returns a FancyCaptcha challenge, CaptchaSaveErrorHandler does not destroy the existing hCaptcha widget first.

What should have happened instead?:

The hCaptcha widget should be destroyed before the FancyCaptcha challenge is rendered.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

Follow-up defensive fix for T426751.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1289986 had a related patch set uploaded (by Mpostoronca; author: Mpostoronca):

[mediawiki/extensions/ConfirmEdit@master] CaptchaSaveErrorHandler: destroy hCaptcha widget on FancyCaptcha response

https://gerrit.wikimedia.org/r/1289986

Change #1289986 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] CaptchaSaveErrorHandler: destroy hCaptcha widget on FancyCaptcha response

https://gerrit.wikimedia.org/r/1289986

dom_walden subscribed.

Unfortunately, I don't see how I can test this. I will move it along.

Dreamy_Jazz subscribed.

Unfortunately, I don't see how I can test this. I will move it along.

Good point. I think the fix is small and clear enough that it should be fine for us to not had the ability to properly QA it