It seems like there's some issues with ConfirmAccount working with ConfirmEdit. Namely, the captcha value doesn't need to be valid in order to be submitted! Topic:Vky60p231ng9i1i4 seems to report the same issue. I can confirm this is not only affecting QuestyCaptcha but also other types such as hCaptcha, and affects versions between MediaWiki 1.31 and 1.35.
Apparently this has been an issue for nearly 4 years. https://phabricator.wikimedia.org/T168783
Borrowing Kghbln's terminology in another thread, an immediate but not final solution is offered here for hCaptcha only. (It is not very pretty and needs a lot of revising to commit to the codebase, but it works as a patch.) Make patches to the following files by replacing their contents with the contents in the link:
MediaWiki 1.35+:
includes/frontend/specialpages/actions/RequestAccount_body.php: https://github.com/mywikis/ConfirmAccount/blob/2f4eca54480992f78a5883d3be9dc04deba6d047/includes/frontend/specialpages/actions/RequestAccount_body.phpincludes/business/AccountRequestSubmission.php: https://github.com/mywikis/ConfirmAccount/blob/2f4eca54480992f78a5883d3be9dc04deba6d047/includes/business/AccountRequestSubmission.phpMediaWiki 1.31:
frontend/specialpages/actions/RequestAccount_body.php: https://github.com/mywikis/ConfirmAccount/blob/fe985841feb6501de5dcfc2bf2dc723cd4ef5ab9/frontend/specialpages/actions/RequestAccount_body.phpbusiness/AccountRequestSubmission.php: https://github.com/mywikis/ConfirmAccount/blob/fe985841feb6501de5dcfc2bf2dc723cd4ef5ab9/business/AccountRequestSubmission.phpFAQs:
1. You might ask, how would I get hCaptcha working on MediaWiki 1.31 when it is only for MediaWiki 1.35+?
Simple, just make sure you change line 139 protected function addCaptchaAPI( (as seen at https://github.com/wikimedia/mediawiki-extensions-ConfirmEdit/blob/master/hCaptcha/includes/HCaptcha.php#L139) to public function addCaptchaAPI(. That's it! Follow instructions for installing hCaptcha as normal otherwise and ignore the fact that it is only made for 1.35+. Another issue might appear that will cause pages such as Special:CreateAccount to error with the call to the addCSPSources() method on line 41 of HTMLHCaptchaField.php, but it can be fixed by removing that function call, since MediaWiki 1.31 doesn't offer support for this (as seen at https://github.com/wikimedia/mediawiki-extensions-ConfirmEdit/blob/master/hCaptcha/includes/HTMLHCaptchaField.php#L41).
2. Why does this patch only work for hCaptcha?
The way that ConfirmEdit and ConfirmAccount work together currently to "handle" captchas (or more precisely, don't handle captchas) is not easily fixable. This interim solution simply enables the form to accept the necessary captcha fields and adds a cURL request to the hCaptcha endpoint and evaluates its response. This was pretty easy to implement without referring to too many ConfirmEdit configuration variables and functions. We only made this patch for hCaptcha because MyWikis has moved to using hCaptcha on all wikis instead of QuestyCaptcha or reCAPTCHA. Our reasons for this choice are listed on our blog, and in our experience, reCAPTCHA is useless and has long been cracked by spambots. If you have a compelling reason for us to develop a temporary patch for QuestyCaptcha, leave a message below.
3. Are there any known issues with this patch?
I should note there is a small bug where hCaptcha doesn't populate the token passed along in the form submission if you previously submitted the form and ConfirmAccount gave you an error. But the patch makes up for it by adding an error message that encourages the user to leave and come back to the page to try again. Plus, nobody would be submitting the page without a captcha done in the first place except by mistake.