Last modified: 2013-09-26 10:03:51 UTC
- Check "Prompt me when entering a blank edit summary" in user preferences. - Edit a page including external links, without putting a summary. - fill out the CAPTCHA - "Reminder: You have not provided an edit summary. If you click Save again, your edit will be saved without one."; Click save. - Get another CAPTCHA to fill out. You're now caught in a loop until you put an edit summary.
I forgot to say that I tested this on the english Wikipedia
I'm strongly toying with the idea of moving this preference to use a bit of JavaScript, rather than fiddling about checking values on POST; the likely audience for the feature most probably have it enabled, so I doubt anyone's going to lose out.
*** Bug 18126 has been marked as a duplicate of this bug. ***
Full support, Rob. The current user interface is extremely confusing. You click "save page", get a warning about a "missing edit summary" on top of the page, while the edit summary line is hidden somewhere below the edit field, and it is difficult to spot, as it is not highlighted at all. A small piece of Javascript code should provide more usability. For example, as long as the summary is not filled out, highlight it in red and give a warning message.
Extension ConfirmEdit has to pass wpIgnoreBlankSummary. Description in EditPage.php: # If a blank edit summary was previously provided, and the appropriate # user preference is active, pass a hidden tag as wpIgnoreBlankSummary. This will stop the # user being bounced back more than once in the event that a summary # is not required.
Created attachment 6296 [details] checks for $editPage->allowBlankSummary fixed in the attached patch
Done in r54215
Reverted in r54260, breaks captcha.
nikerabbit is right, an attacker could just add wpIgnoreBlankSummary to the source code and circumvent the captcha. A way to fix this would be to provide a token after the captcha has been solved. However, the usability of forcesummary is already so bad that a complete rewrite or alternatives (Javascript for example) are perhaps more appropriate.
Created attachment 7302 [details] reassign wpCaptchaId and wpIgnoreBlankSummary The patch reassign the wpIgnoreBlankSummary field so the forceeditsummary is not shown twice. It also reassign the wpCaptchaId so the captcha is not shown twice. Maybe it is a bad idea to reuse the old value, then let storeCaptcha() create a new one.
Comment on attachment 6296 [details] checks for $editPage->allowBlankSummary This patch breaks captcha, see comment 8, marking obsolete
I am not sure, if my patch was the best way to do it. Marking as obsolete, maybe a other developer find a good way.
This needs a new design.
