Page MenuHomePhabricator

[QuestyCaptcha] Store questions and answers in an automatically encrypted page, whose plaintext is viewable only by sysops
Open, LowestPublicFeature

Description

If we were to store QuestyCaptcha questions and answers in an automatically encrypted page, whose plaintext is viewable only by sysops, then we could use the revision history system to store old copies of it, and changes would not require edits to LocalSettings.php.

The content to be saved to the page should be encrypted by, e.g., a [[mw:Manual:Hooks/PageContentSave]] function. [[mw:Manual:Hooks/ParserBeforeStrip]] could be used to display to the sysop a decrypted version of it. It would also be necessary to put that decrypted text in sysops' edit windows when they edit; I haven't tried to figure out yet what hook that would be.

Encryption keys could be stored in, say, [[mw:Manual:page_props]] or maybe [[mw:Manual:user_properties]] or [[mw:Manual:config table]].


Version: unspecified
Severity: enhancement
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=34911

Event Timeline

bzimport raised the priority of this task from to Lowest.Nov 22 2014, 3:07 AM
bzimport set Reference to bz61302.
bzimport added a subscriber: Unknown Object (MLST).

I think bug 34911 is a better idea.

(In reply to Kunal Mehta (Legoktm) from comment #1)

I think bug 34911 is a better idea.

A number of different proposals are presented by the commenters there; which do you favor? Of course, if the config database gets implemented, then this is kinda moot, but I'm not sure how far off that is.

The code in [[mw:Extension:InterwikiMap]] for parsing and using the contents of the MediaWiki:Interwiki-whitelist might provide inspiration for how to do something similar with the page of questions and answers. Also, some code from [[mw:Extension:ROT13]] might be used, although a stronger encryption algorithm would be needed.

Change 680756 had a related patch set uploaded (by Legoktm; author: Jack Phoenix):

[mediawiki/extensions/ConfirmEdit@master] The mythical on-wiki QuestyCaptcha editor special page

https://gerrit.wikimedia.org/r/680756

Aklapper changed the subtype of this task from "Task" to "Feature Request".Feb 4 2022, 11:14 AM

A shame that this never picked up the necessary traction. Anyway, my aforementioned patch (which, obviously, nowadays needs rebasing) is available as a standalone* extension called "QuestyCaptchaEditor", though there's a major perf issue that should be handled and the fact that it needs a core hack isn't so great either (but that's a non-issue if the code were to be merged into ConfirmEdit; said core hack is needed only because both ConfirmEdit and QuestyCaptchaEditor set $wgCaptchaClass and core enforces that only one extension may set it and others can't set it afterwards).

* standalone as in "self-contained to the extent that it is possible", it's obviously an extension to ConfirmEdit, which in turn itself is an extension to MediaWiki, so you do the math.