Page MenuHomePhabricator

Edit summary reminder preference conflicts with CAPTCHA extensions
Closed, ResolvedPublic

Description

Author: kevinlamontagne

Description:

  • Check "Prompt me when entering a blank edit summary" in user preferences.
  • Edit a page including external links, without putting a summary.
  • fill out the CAPTCHA
  • "Reminder: You have not provided an edit summary. If you click Save again, your edit will be saved without one."; Click save.
  • Get another CAPTCHA to fill out. You're now caught in a loop until you put an edit summary.

Version: unspecified
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=20661

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 9:54 PM
bzimport set Reference to bz10729.
bzimport added a subscriber: Unknown Object (MLST).

kevinlamontagne wrote:

I forgot to say that I tested this on the english Wikipedia

robchur wrote:

I'm strongly toying with the idea of moving this preference to use a bit of JavaScript, rather than fiddling about checking values on POST; the likely audience for the feature most probably have it enabled, so I doubt anyone's going to lose out.

  • Bug 18126 has been marked as a duplicate of this bug. ***

Full support, Rob.
The current user interface is extremely confusing. You click "save page", get a warning about a "missing edit summary" on top of the page, while the edit summary line is hidden somewhere below the edit field, and it is difficult to spot, as it is not highlighted at all.
A small piece of Javascript code should provide more usability. For example, as long as the summary is not filled out, highlight it in red and give a warning message.

Extension ConfirmEdit has to pass wpIgnoreBlankSummary.

Description in EditPage.php:

  1. If a blank edit summary was previously provided, and the appropriate
  2. user preference is active, pass a hidden tag as wpIgnoreBlankSummary. This will stop the
  3. user being bounced back more than once in the event that a summary
  4. is not required.

checks for $editPage->allowBlankSummary

fixed in the attached patch

attachment bug.patch ignored as obsolete

Reverted in r54260, breaks captcha.

nikerabbit is right, an attacker could just add wpIgnoreBlankSummary to the source code and circumvent the captcha.
A way to fix this would be to provide a token after the captcha has been solved. However, the usability of forcesummary is already so bad that a complete rewrite or alternatives (Javascript for example) are perhaps more appropriate.

Created attachment 7302
reassign wpCaptchaId and wpIgnoreBlankSummary

The patch reassign the wpIgnoreBlankSummary field so the forceeditsummary is not shown twice. It also reassign the wpCaptchaId so the captcha is not shown twice.

Maybe it is a bad idea to reuse the old value, then let storeCaptcha() create a new one.

attachment bug10729.patch ignored as obsolete

Comment on attachment 6296
checks for $editPage->allowBlankSummary

This patch breaks captcha, see comment 8, marking obsolete

I am not sure, if my patch was the best way to do it. Marking as obsolete, maybe a other developer find a good way.

A possible solution would be to save a key in memcached (e.g. captcha:solved:{edittoken}) with the value, if the captcha was successfully solved or not. If yes, the user doesn't need to solve the captcha again and we can set wpIgnoreBlankSummary. After the edit was successful, the key can be removed.

Any ideas/opinions?

Florian added a project: Contributors-Team.

Actually, this seems to be a problem in mediawiki/core. This would happen for any other extension, which aborts the edit workflow, not only ConfirmEdit.

Change 295603 had a related patch set uploaded (by Florianschmidtwelzow):
Make sure, that "Prompt me when entering a blank edit summary" works with Hooks

https://gerrit.wikimedia.org/r/295603

The patch by @Florian from 2016 still works (after a minor update), and I can't believe this could be so simple to fix.

Change 295603 merged by jenkins-bot:
[mediawiki/core@master] Make sure, that "Prompt me when entering a blank edit summary" works with Hooks

https://gerrit.wikimedia.org/r/295603