Topic on Project:Support desk

Hello,

We've just upgraded to 1.27 from 1.25 and it appears the ConfirmEdit extension has broken backwards compatibility or is broken? We use the QuestyCaptcha module with HTML/JS (in $wgCaptchaQuestions) and it appears the extension now displays the actual HTML (i.e. it escapes the string we passed to the $wgCaptchaQuestions instead of passing it as it to the web page).

Is this a known/intentional bug/change? Because it's fairly big breaking change and quite a few wikis rely on this specific feature to support raw/HTML string.

I just tested MediaWiki 1.27 with ConfirmEdit+QuestyCaptcha (branches 1.25 and 1.27) and the HTML I insert in the question is directly transmitted as raw HTML (even <iframe>), so I cannot see any possible bug.

• Can you give the HTML/question you tried to insert? (or an equivalent HTML/question if you don’t want to give the original question)
• Is your wiki public? Else can you give the versions of ConfirmEdit and QuestyCaptcha indicated on the page "Special:Version"?

MediaWiki 1.27.1 / ConfirmEdit 1.4.0

A simple example would be:

$wgCaptchaQuestions[] = array( 'question' => '<strong>some question</strong>', 'answer' => 'someanswer' );

That literally shows up as "<strong>some question</strong>" on the web page.

A more practical example similar to what we do (albeit our's bit more complicated) is something like this:

$wgCaptchaQuestions[] = array( 'question' => '<img src="https://upload.wikimedia.org/wikipedia/commons/7/74/White_domesticated_duck%2C_stretching.jpg" alt="" title="" />', 'answer' => 'duck' );

Instead of the image loading up of course, we get the actual HTML showing up on the page.

I would remove the HTML from the questions, because it does not belong there. Instead, if you want to have bold print, you should add an according CSS rule to the wiki page MediaWiki:Common.css in your wiki!

The bold was just an example of HTML that should be rendered correctly but doesn't. See Extension:QuestyCaptcha for example usage of HTML in the question. It's a feature many wikis utilize. Just doesn't seem to work anymore for us.

Maybe the extension, or MediaWiki, was patched to prevent HTML injection in some interface messages affecting this. If that's the case (and it seems to be), you should bugreport it so developers of the extension are aware