Steps to replicate the issue (include links if applicable):
- On a wiki with AbuseFilter + ConfirmEdit and the showcaptcha custom action enabled ($wgConfirmEditEnabledAbuseFilterCustomActions = [ 'showcaptcha' ]), create an AbuseFilter matching uploads (e.g. action contains "upload") with the "Require CAPTCHA verification to perform the action" (showcaptcha) consequence.
- Upload a file as a user matched by the filter — via Special:UploadWizard.
- Watch the ConfirmEdit log channel and the abuse_filter_log entry for the hit.
What happens?:
On UploadWizard, adding a file runs the stash phase (action = stashupload) and the filter matches — abuse_filter_log records the hit (filter 5, afl_action = stashupload) but with afl_actions empty. ConfirmEdit logs:
> [ConfirmEdit] Filter 5: stashupload is not defined in the list of triggers known to ConfirmEdit
because stashupload is not in CaptchaTriggers::CAPTCHA_TRIGGERS, so CaptchaConsequence::execute() returns false and the showcaptcha consequence does nothing.
What should have happened instead?:
The showcaptcha consequence should force a CAPTCHA for the matched upload (including for users who would otherwise skip the CAPTCHA), the same way it works for edit, createaccount, etc.