Page MenuHomePhabricator

Update hCaptcha code in mediawiki-config to no longer depend on the action parameter of the main context request
Closed, ResolvedPublic

Description

The code at https://gerrit.wikimedia.org/g/operations/mediawiki-config/+/66a3710620a8693b7c3666e0584a7c7d042e75a5/wmf-config/CommonSettings.php#2226 checks if the value of the action parameter in the main context request is visualeditoredit (or discussiontoolsedit). This caused T426751: Stuck in FancyCaptcha challenge loop on VisualEditor when ApiEditPage was updated to also set the main context request to the API request (it only set $wgRequest before that). The core patch was reverted again and I've since filed T426894: Fix discrepancy between $wgRequest and the main context request in ApiEditPage, which is now blocked by this task.

The code should no longer depend on action=visualeditoredit/action=discussiontoolsedit in the main context request, but instead check if the current edit is a VE/DiscussionTools edit through $_REQUEST.

Event Timeline

The same will have to be done for ApiDiscussionToolsEdit, which calls action=visualeditoredit internally.

SomeRandomDeveloper renamed this task from Update hCaptcha code in mediawiki-config to no longer depend on action=visualeditoredit to Update hCaptcha code in mediawiki-config to no longer depend on action=visualeditoredit/discussiontoolsedit.May 23 2026, 1:09 AM
SomeRandomDeveloper updated the task description. (Show Details)

Change #1292362 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/VisualEditor@master] Set "isvisualeditoredit" parameter when saving an edit

https://gerrit.wikimedia.org/r/1292362

Change #1292363 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/DiscussionTools@master] Set "isdiscussiontoolsedit" parameter when saving an edit

https://gerrit.wikimedia.org/r/1292363

Change #1292364 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[operations/mediawiki-config@master] Update hCaptcha checks to support isvisualeditoredit/isdiscussiontoolsedit

https://gerrit.wikimedia.org/r/1292364

A very hackish solution (but the whole code is hackish, so it wouldn’t make it that much worse): what if the config code directly accessed $_REQUEST['action']? That would mean no need for changes in VE or DT.

A very hackish solution (but the whole code is hackish, so it wouldn’t make it that much worse): what if the config code directly accessed $_REQUEST['action']? That would mean no need for changes in VE or DT.

Yeah, we should probably consider doing this. It is done for other ConfirmEdit (CAPTCHA extension) related config on WMF wikis

I'm fine with that as well, I'll update my patch.

Change #1292363 abandoned by SomeRandomDeveloper:

[mediawiki/extensions/DiscussionTools@master] Set "isdiscussiontoolsedit" parameter when saving an edit

Reason:

Using $_REQUEST instead in the config code

https://gerrit.wikimedia.org/r/1292363

Change #1292362 abandoned by SomeRandomDeveloper:

[mediawiki/extensions/VisualEditor@master] Set "isvisualeditoredit" parameter when saving an edit

Reason:

Using $_REQUEST instead in the config code

https://gerrit.wikimedia.org/r/1292362

Change #1292364 merged by jenkins-bot:

[operations/mediawiki-config@master] Update hCaptcha checks to retrieve API parameters from $_REQUEST

https://gerrit.wikimedia.org/r/1292364

Mentioned in SAL (#wikimedia-operations) [2026-06-03T12:27:01Z] <dreamyjazz@deploy1003> Started scap sync-world: Backport for [[gerrit:1292364|Update hCaptcha checks to retrieve API parameters from $_REQUEST (T427105)]]

Mentioned in SAL (#wikimedia-operations) [2026-06-03T12:28:59Z] <dreamyjazz@deploy1003> somerandomdeveloper, dreamyjazz: Backport for [[gerrit:1292364|Update hCaptcha checks to retrieve API parameters from $_REQUEST (T427105)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-06-03T12:38:17Z] <dreamyjazz@deploy1003> Finished scap sync-world: Backport for [[gerrit:1292364|Update hCaptcha checks to retrieve API parameters from $_REQUEST (T427105)]] (duration: 11m 15s)

SomeRandomDeveloper renamed this task from Update hCaptcha code in mediawiki-config to no longer depend on action=visualeditoredit/discussiontoolsedit to Update hCaptcha code in mediawiki-config to no longer depend on the action parameter of the main context request.Jun 3 2026, 2:20 PM
SomeRandomDeveloper closed this task as Resolved.
SomeRandomDeveloper claimed this task.
SomeRandomDeveloper updated the task description. (Show Details)