Core Rule Set: MediaWiki's password fields pass on a wiki in any language (closes #299)

A wiki in another language posts its sign-up, password change and
new-password forms to its own names for the special pages, such as
Spezial:Benutzerkonto_anlegen. So password and retype no longer match on
the English page name. They skip the rules when authAction names the
form that sends them: change, create or login-continue. MediaWiki sends
the same value in every language. The page must still be MediaWiki's,
with a namespace in its title, so another app's paths under /index.php/
keep every rule. The two rules move to phase 2 to read the body.

Adds requests recorded from a German MediaWiki 1.46.2.

Model: opus-5-5

internal/coreruleset/mediawiki_test.go

@@ -248,26 +248,52 @@ func TestMediaWikiSignUpAndPasswordChangeFieldsPass(t *testing.T) {
 	// The form that changes a password posts to this subpage.
 	const subpage = "/MediaWiki%5CAuth%5CPasswordAuthenticationRequest"
 
+	// The forms send authAction in the body, and MediaWiki reads it from the
+	// query too. These requests send it in the query, so that the body holds
+	// only the passwords. The recorded requests send it in the body.
+	const (
+		create        = "authAction=create"
+		loginContinue = "authAction=login-continue"
+		changeAction  = "authAction=change"
+	)
+
 	change := []string{passwordKey, retypeKey}
 	retype := []string{retypeKey}
 
 	wantPasswordFieldsPass(t, []passwordFields{
-		{mediawikiSignUp, formData, retype},
-		{"/index.php/Special:CreateAccount", formData, retype},
-		{"/index.php?title=Special:CreateAccount&returnto=Main_Page", formData, retype},
-		{"/wiki/Special:UserLogin", formData, retype},
-		{mediawikiSignIn, formData, retype},
-		{mediawikiAccountChange, formData, change},
-		{mediawikiAccountChange + subpage, formData, change},
-		{"/index.php/Special:ChangeCredentials", formData, change},
-		{"/index.php?title=Special:ChangeCredentials" + subpage, formData, change},
-		{"/w/index.php?title=Special:ChangeCredentials", formData, change},
+		{mediawikiSignUp + "?" + create, formData, retype},
+		{"/index.php/Special:CreateAccount?" + create, formData, retype},
+		{
+			"/index.php?title=Special:CreateAccount&returnto=Main_Page&" + create,
+			formData, retype,
+		},
+		{"/wiki/Special:UserLogin?" + loginContinue, formData, retype},
+		{mediawikiSignIn + "&" + loginContinue, formData, retype},
+		{mediawikiAccountChange + "?" + changeAction, formData, change},
+		{mediawikiAccountChange + subpage + "?" + changeAction, formData, change},
+		{"/index.php/Special:ChangeCredentials?" + changeAction, formData, change},
+		{
+			"/index.php?title=Special:ChangeCredentials" + subpage + "&" + changeAction,
+			formData, change,
+		},
+		{"/w/index.php?title=Special:ChangeCredentials&" + changeAction, formData, change},
+		// A German wiki's names for the same pages.
+		{"/index.php/Spezial:Benutzerkonto_anlegen?" + create, formData, retype},
+		{
+			"/index.php?title=Spezial:Anmelden&returnto=Hauptseite&" + loginContinue,
+			formData, retype,
+		},
+		{
+			"/wiki/Spezial:Anmeldeinformationen_%C3%A4ndern" + subpage + "?" + changeAction,
+			formData, change,
+		},
 		{mediawikiAPI, formData, retype},
 	})
 }
 
 // Other apps use the names password and retype too. So these fields keep every
-// rule on any page that does not take them, whatever title the query names.
+// rule unless the page is MediaWiki's, its title has a namespace, and
+// authAction names a form that sends the field.
 func TestMediaWikiPasswordFieldsStayCheckedOffTheirPages(t *testing.T) {
 	t.Parallel()
 
@@ -277,15 +303,17 @@ func TestMediaWikiPasswordFieldsStayCheckedOffTheirPages(t *testing.T) {
 
 	for _, sent := range []struct{ target, name string }{
 		{appPath, passwordKey},
-		{appPath, retypeKey},
-		{appPath + "?title=Special:ChangeCredentials", passwordKey},
-		{appPath + "?title=Special:CreateAccount", retypeKey},
-		{"/index.php?title=Main_Page", passwordKey},
-		{"/index.php/Main_Page", retypeKey},
-		{"/wiki/Main_Page", passwordKey},
-		{"/wiki/Special:ChangeCredentialsExample", passwordKey},
-		{mediawikiSignUp, passwordKey},
-		{"/index.php?title=Special:CreateAccount", passwordKey},
+		{appPath + "?authAction=create", retypeKey},
+		{appPath + "?title=Special:ChangeCredentials&authAction=change", passwordKey},
+		{appPath + "?title=Special:CreateAccount&authAction=create", retypeKey},
+		{"/index.php?title=Main_Page&authAction=change", passwordKey},
+		{"/index.php/Main_Page?authAction=create", retypeKey},
+		{"/wiki/Main_Page?authAction=change", passwordKey},
+		{mediawikiAccountChange, passwordKey},
+		{mediawikiAccountChange + "?authAction=login", passwordKey},
+		{mediawikiSignUp + "?authAction=create", passwordKey},
+		{"/index.php?title=Special:CreateAccount&authAction=create", passwordKey},
+		{"/index.php/Spezial:Anmelden?authAction=login", retypeKey},
 	} {
 		r := request{http.MethodPost, sent.target, []string{formData}}