Page MenuHomePhabricator
Create Task
Maniphest T426943

hCaptcha risk scores (MobileFrontend): Load ext.confirmEdit.hCaptcha when a block message is shown
Closed, ResolvedPublic1 Estimated Story Points
Actions

Description

MobileFrontend's blockMessageDrawer already has code for tracking when a block is shown.

Once we add support for loading hCaptcha's frontend module unconditionally, we may trigger a hook from blockMessageDrawer that would be handled by ConfirmEdit to submit hte risk score.

I have identified two cases when a block notice is shown when the MF is active:

  • Accessing a page directly when you have a block (i.e. http://host/w/index.php?title=New_Page&action=submit)
    • This is already covered by the same codepath used by the desktop editor: page loads, BeforePageDisplayHookHandler detects the block and loads hCaptcha FE modules
  • Clicking on the edit icon while reading a page
    • This required adding new hooks

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
hCaptcha: Add missing param type in jsDoc blockmediawiki/extensions/ConfirmEditmaster+9 -0
hCaptcha risk scores: VE plugin to collect risk scores for block noticesmediawiki/extensions/ConfirmEditmaster+394 -35
hCaptcha risk scores: VE plugin to collect risk scores for block noticesmediawiki/extensions/ConfirmEditwmf/1.47.0-wmf.5+394 -35
hCaptcha: Collect risk scores from MobileFrontend eventsmediawiki/extensions/ConfirmEditmaster+708 -146
hcaptcha: Support loading additional frontend modules in block messagesmediawiki/extensions/MobileFrontendmaster+104 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

• hector.arroyo created this task.Thu, May 21, 8:48 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptThu, May 21, 8:48 AM
• hector.arroyo renamed this task from hCaptcha risk scores: Load ext.confirmEdit.hCaptcha when a block message is shown to hCaptcha risk scores (MobileFrontend): Load ext.confirmEdit.hCaptcha when a block message is shown.Thu, May 21, 8:49 AM
• hector.arroyo changed the task status from Open to In Progress.
• hector.arroyo set the point value for this task to 1.
• hector.arroyo added a parent task: T424629: [epic] WE4.10.5 hCaptcha risk scores for blocked edit notices.
• hector.arroyo updated the task description. (Show Details)Thu, May 21, 8:55 AM
• hector.arroyo updated the task description. (Show Details)Thu, May 21, 9:08 AM
gerritbot added a comment.Thu, May 21, 11:41 AM

Change #1290720 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/MobileFrontend@master] hcaptcha: Support loading additional frontend modules from bock messages

https://gerrit.wikimedia.org/r/1290720

gerritbot added a project: Patch-For-Review.Thu, May 21, 11:42 AM
gerritbot added a comment.Thu, May 21, 12:38 PM

Change #1290753 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Support for collecting resk scores for blocks from the MobileFrontend

https://gerrit.wikimedia.org/r/1290753

OKryva-WMF added projects: ConfirmEdit (CAPTCHA extension), Bot detection and mitigation (WE4.10 hCaptcha).Thu, May 21, 4:12 PM
• hector.arroyo added a project: hCaptcha.Thu, May 21, 5:03 PM
• hector.arroyo added a project: MobileFrontend (MobileFrontend (Editor)).Thu, May 21, 5:07 PM
• hector.arroyo updated the task description. (Show Details)Fri, May 22, 1:09 PM
• hector.arroyo updated the task description. (Show Details)Fri, May 22, 2:51 PM
• hector.arroyo moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.Fri, May 22, 3:13 PM
• hector.arroyo moved this task from Backlog to Awaiting Code Review on the ConfirmEdit (CAPTCHA extension) board.
• hector.arroyo moved this task from Backlog to In progress on the Bot detection and mitigation (WE4.10 hCaptcha) board.
• hector.arroyo moved this task from Backlog to Triaged on the MobileFrontend (MobileFrontend (Editor)) board.
OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)); removed: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)).Mon, May 25, 12:40 PM
OKryva-WMF moved this task from Backlog to Needs review on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.Mon, May 25, 12:41 PM
gerritbot added a comment.Thu, May 28, 10:27 PM

Change #1290720 merged by jenkins-bot:

[mediawiki/extensions/MobileFrontend@master] hcaptcha: Support loading additional frontend modules in block messages

https://gerrit.wikimedia.org/r/1290720

gerritbot added a comment.Fri, May 29, 4:47 PM

Change #1295484 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hCaptcha risk scores: VE plugin to collect risk scores for block notices

https://gerrit.wikimedia.org/r/1295484

gerritbot added a comment.Mon, Jun 1, 9:36 PM

Change #1290753 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Collect risk scores from MobileFrontend events

https://gerrit.wikimedia.org/r/1290753

Dreamy_Jazz moved this task from Needs review to QA in Prod on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.Wed, Jun 3, 9:48 PM
gerritbot added a comment.Wed, Jun 3, 10:00 PM

Change #1295484 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hCaptcha risk scores: VE plugin to collect risk scores for block notices

https://gerrit.wikimedia.org/r/1295484

ReleaseTaggerBot added a project: MW-1.47-notes (1.47.0-wmf.6; 2026-06-09).Wed, Jun 3, 10:00 PM
Maintenance_bot removed a project: Patch-For-Review.Wed, Jun 3, 10:31 PM
gerritbot added a comment.Thu, Jun 4, 5:51 AM

Change #1297536 had a related patch set uploaded (by Kosta Harlan; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.5] hCaptcha risk scores: VE plugin to collect risk scores for block notices

https://gerrit.wikimedia.org/r/1297536

gerritbot added a project: Patch-For-Review.Thu, Jun 4, 5:51 AM
gerritbot added a comment.Thu, Jun 4, 7:15 AM

Change #1297536 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.47.0-wmf.5] hCaptcha risk scores: VE plugin to collect risk scores for block notices

https://gerrit.wikimedia.org/r/1297536

Stashbot mentioned this in T424629: [epic] WE4.10.5 hCaptcha risk scores for blocked edit notices.Thu, Jun 4, 7:25 AM

Mentioned in SAL (#wikimedia-operations) [2026-06-04T07:25:09Z] <kharlan@deploy1003> Started scap sync-world: Backport for [[gerrit:1297536|hCaptcha risk scores: VE plugin to collect risk scores for block notices (T426943)]], [[gerrit:1297200|hCaptcha: Render a fresh mobile widget for each captcha attempt (T425929)]], [[gerrit:1297173|hCaptcha: Enable risk-score collection for users blocked by IP blocks (T424629)]]

Stashbot mentioned this in T425929: Cannot publish after dismissing hCaptcha challenge triggered by AbuseFilter on mobile source editor.Thu, Jun 4, 7:25 AM
Stashbot added a comment.Thu, Jun 4, 7:27 AM

Mentioned in SAL (#wikimedia-operations) [2026-06-04T07:27:12Z] <kharlan@deploy1003> kharlan, harroyo-wmf: Backport for [[gerrit:1297536|hCaptcha risk scores: VE plugin to collect risk scores for block notices (T426943)]], [[gerrit:1297200|hCaptcha: Render a fresh mobile widget for each captcha attempt (T425929)]], [[gerrit:1297173|hCaptcha: Enable risk-score collection for users blocked by IP blocks (T424629)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwd

Maintenance_bot removed a project: Patch-For-Review.Thu, Jun 4, 7:31 AM
Stashbot added a comment.Thu, Jun 4, 7:34 AM

Mentioned in SAL (#wikimedia-operations) [2026-06-04T07:34:05Z] <kharlan@deploy1003> Finished scap sync-world: Backport for [[gerrit:1297536|hCaptcha risk scores: VE plugin to collect risk scores for block notices (T426943)]], [[gerrit:1297200|hCaptcha: Render a fresh mobile widget for each captcha attempt (T425929)]], [[gerrit:1297173|hCaptcha: Enable risk-score collection for users blocked by IP blocks (T424629)]] (duration: 08m 56s)

ReleaseTaggerBot edited projects, added: MW-1.47-notes (1.47.0-wmf.5; 2026-06-02); removed: MW-1.47-notes (1.47.0-wmf.6; 2026-06-09).Thu, Jun 4, 8:00 AM
gerritbot added a comment.Thu, Jun 4, 8:37 AM

Change #1297623 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Add missing param type in jsDoc block

https://gerrit.wikimedia.org/r/1297623

gerritbot added a project: Patch-For-Review.Thu, Jun 4, 8:37 AM
gerritbot added a comment.Thu, Jun 4, 8:59 AM

Change #1297623 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Add missing param type in jsDoc block

https://gerrit.wikimedia.org/r/1297623

ReleaseTaggerBot edited projects, added: MW-1.47-notes (1.47.0-wmf.6; 2026-06-09); removed: MW-1.47-notes (1.47.0-wmf.5; 2026-06-02).Thu, Jun 4, 9:00 AM
Maintenance_bot removed a project: Patch-For-Review.Thu, Jun 4, 9:31 AM
• hector.arroyo moved this task from In progress to QA on the Bot detection and mitigation (WE4.10 hCaptcha) board.Fri, Jun 5, 10:33 AM
• hector.arroyo moved this task from Awaiting Code Review to Feature Requests/Improvements on the ConfirmEdit (CAPTCHA extension) board.Mon, Jun 8, 9:38 AM
• hector.arroyo closed this task as Resolved.Tue, Jun 9, 8:58 AM
• hector.arroyo moved this task from QA to Done on the Bot detection and mitigation (WE4.10 hCaptcha) board.

This is working as expected (tested locally with the master branches of the MobileFrontend and ConfirmEdit).

image.png (1,330×795 px, 161 KB)
image.png (1,359×804 px, 205 KB)

• hector.arroyo moved this task from QA in Prod to Done on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.Tue, Jun 9, 8:59 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits