Summary
The VisualEditor integration with hCaptcha submits a hCaptcha response token alongside the API request. If this API request fails because an AbuseFilter denies the edit, the next attempt to save the edit without closing the save changes dialog will cause the request to reuse the token
Steps to reproduce
- Open the VisualEditor editor with a user who lacks the skipcaptcha right
- Change the page in a way which should trigger an AbuseFilter to deny the edit
- Open the save changes dialog and submit the edit
- Press "retry" when greeted with the notice that an abusefilter has denied the edit (without closing the save changes dialog)
Acceptance criteria
- The hCaptcha response token is not used in the VisualEditor handler for more than one request, and so is regenerated for each edit attempt