Page MenuHomePhabricator

hCaptcha widget not rendering after "warn" AbuseFilter consequence on desktop wikitext editor
Closed, ResolvedPublic

Description

Summary

As noted on wiki, the hCaptcha widget is not rendering properly after an AbuseFilter with a "warn" consequence is tripped. The sequence of events appears to be:

  1. User submits edit, solving the hCaptcha challenge
  2. AbuseFilter prevents the edit with a "warn" consequence, the page is reloaded
  3. No hCaptcha widget is present on the page
  4. User submits the edit again, but there's no hCaptcha token
  5. Error message about incorrect or missing CAPTCHA shown to the user

Acceptance criteria

  • An AbuseFilter "warn" consequence does not result in broken edit submissions for desktop wikitext editor, mobilefrontend source editor, desktop/mobile VisualEditor, and DiscussionTools

Event Timeline

kostajh triaged this task as High priority.Jun 8 2026, 11:41 AM

Do we know if this happens outside the wikitext desktop source editor?

Do we know if this happens outside the wikitext desktop source editor?

I don't know, I just included other editing interfaces in the acceptance criteria to make sure that we check for this while working on the task

kostajh renamed this task from hCaptcha widget not rendering after "warn" AbuseFilter consequence to hCaptcha widget not rendering after "warn" AbuseFilter consequence on desktop wikitext editor.Jun 8 2026, 12:02 PM

After further testing, it looks like MobileFrontend source editor ignores the AbuseFilter "warn" consequence and allows the edit to be saved. That's a bug on its own, but separate from this issue. The other interfaces seem fine (VE on desktop/mobile, DiscussionTools), so it's just deskop wikitext editor that needs a fix.

Change #1298751 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@master] SimpleCaptcha: Re-render captcha when edit form is redisplayed

https://gerrit.wikimedia.org/r/1298751

Change #1298751 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] SimpleCaptcha: Re-render captcha when edit form is redisplayed

https://gerrit.wikimedia.org/r/1298751

Change #1298879 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.5] SimpleCaptcha: Re-render captcha when edit form is redisplayed

https://gerrit.wikimedia.org/r/1298879

Change #1298879 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.5] SimpleCaptcha: Re-render captcha when edit form is redisplayed

https://gerrit.wikimedia.org/r/1298879

Mentioned in SAL (#wikimedia-operations) [2026-06-08T19:25:41Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:rEVED12988790abc4|SimpleCaptcha: Re-render captcha when edit form is redisplayed (T428437)]]

Mentioned in SAL (#wikimedia-operations) [2026-06-08T19:29:41Z] <kharlan@deploy1003> kharlan: Backport for [[gerrit:rEVED12988790abc4|SimpleCaptcha: Re-render captcha when edit form is redisplayed (T428437)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-06-08T20:03:25Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:rEVED12988790abc4|SimpleCaptcha: Re-render captcha when edit form is redisplayed (T428437)]] (duration: 37m 43s)

@kostajh One thing I notice is that if I trigger an AbuseFilter which has both the warn and showcaptcha consequences, I am shown the warning twice and have to fill in the hCaptcha challenge twice.

I don't know how common such filters will be on production (I have only found one on enwiki, which is currently disabled).

@kostajh One thing I notice is that if I trigger an AbuseFilter which has both the warn and showcaptcha consequences, I am shown the warning twice and have to fill in the hCaptcha challenge twice.

I don't know how common such filters will be on production (I have only found one on enwiki, which is currently disabled).

Thanks for flagging that. I would say that's probably enough of an edge case to not worry about for now.

I can no longer reproduce the bug in the description. I have raised T429569 for the bug described in T428437#12004543.