The obvious way to fix this would break the actual purpose of <includeonly>,
which is to keep special links such as category links meant to belong to
target pages from being indicated on the template page.

circeus wrote:

Isn't it possible to have it work only for "whatlinkshere"-style funcions?

I believe a reasonable solution would be to use the "obvious fix", but
explicitly exclude categories. Yes, it means yet another parser kluge, and
there are still ways in which a clever deliberate vandal could work around it,
but it does solve the common case and would have practical benefits beyond just
vandal-fighting.

Of course, if we wanted to get fancy, we could add a new section to category
pages: "Templates that add a page to this category when transcluded"...

conrad.dunkerson wrote:

If a template is widely transcluded then the 'file links' list of any image
attached to it is going to be very long and difficult to sort through to locate
the template... if it can be made to show up in the list despite <includeonly>
tags in the first place. Another option might be to expand the list of
transcluded pages which is shown when the user clicks 'edit' to also list
included pictures... if pictures brought in by templates could be listed under
the appropriate template that could immediately identify the problem.

neroute2 wrote:

Actually it won't be hard to sort through, because it will update only when each
page is refreshed (I believe) and there's no maximum number of entries, so
searching for "template" will find it right away.

titoxd.wikimedia wrote:

Isn't it possible to do the "obvious fix" on the imagelinks table only? Then,
that way, you can declare <noinclude>'d images (which are the entire issue) as
also included on the template.

Another solution would be to mark them the way Ilmari suggests, with a
"transcluded in all pages in which this template is transcluded", similar to the
(transclusion) marker on [[Special:Whatlinkshere]].

No, that's not really possible without some significant retooling.
The <noinclude>, <onlyinclude>, <includeonly> etc sections are handled by simply
removing sections of text before parsing continues. There's no way to know
whether a particular link as it's being parsed is or is not inside such a
section; it's just either there or isn't.

So to treat some kinds of markup differently from others would require
completely changing how these sections are handled; which would very likely
change the behavior of them, which might break thousands of templates.

cf bug 9293

Changing all WONTFIX high priority bugs to lowest priority (no mail should be generated since I turned it off for this.)