Core Rule Set: MediaWiki's password fields pass on a wiki in any language (closes #299)

A wiki in another language posts its sign-up, password change and
new-password forms to its own names for the special pages, such as
Spezial:Benutzerkonto_anlegen. So password and retype no longer match on
the English page name. They skip the rules when authAction names the
form that sends them: change, create or login-continue. MediaWiki sends
the same value in every language. The page must still be MediaWiki's,
with a namespace in its title, so another app's paths under /index.php/
keep every rule. The two rules move to phase 2 to read the body.

Adds requests recorded from a German MediaWiki 1.46.2.

Model: opus-5-5

internal/coreruleset/mediawiki.conf

@@ -194,18 +194,26 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?api\.php$" \
         ctl:ruleRemoveTargetById=944150;ARGS:/^(?:lgpassword|password|retype)$/"
 
 # Other apps use the names password and retype too, and these exclusions apply
-# in front of every app. So these two fields skip the same rules only on the
-# pages that take them:
-#   password, retype: changing the password at Special:ChangeCredentials
-#   retype: signing up at Special:CreateAccount
-#   retype: setting the new password after a reset at Special:UserLogin
-# The path names the page, or the path is /index.php and title names it. A title
-# on any other path does not count, so another app's paths under /index.php/
-# keep every rule.
-SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/Special:ChangeCredentials(?:/|$)" \
-    "id:900919,phase:1,pass,nolog,chain"
-    SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?Special:ChangeCredentials(?:/|$)" "chain"
-    SecRule &ARGS_GET:/^(?:password|retype)$/ "@eq 0" \
+# in front of every app. So these two fields skip the same rules only in the
+# forms that send them. Each of these forms sends the field authAction, whose
+# value is the same in every language:
+#   password, retype: authAction=change, changing the password at
+#   Special:ChangeCredentials
+#   retype: authAction=create, signing up at Special:CreateAccount
+#   retype: authAction=login-continue, setting a new password at
+#   Special:UserLogin after a reset or once the old one expired
+# A wiki in another language posts these forms to its own names for the pages,
+# such as Spezial:Benutzerkonto_anlegen on a German wiki. So the page's name
+# does not count, but its title must have a namespace, such as Special: or
+# Spezial:. The title follows /index.php/ or /wiki/ in the path, or is the title
+# of /index.php. A title on any other path does not count, so another app's
+# paths under /index.php/ keep every rule. These rules are in phase 2, because
+# the forms send authAction in the body.
+SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/[^/:]+:" \
+    "id:900919,phase:2,pass,nolog,chain"
+    SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?[^/:]+:" "chain"
+    SecRule &ARGS_GET:/^(?:password|retype)$/ "@eq 0" "chain"
+    SecRule ARGS:authAction "@streq change" \
         "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:password|retype)$/,\
         ctl:ruleRemoveTargetById=920540;ARGS:/^(?:password|retype)$/,\
         ctl:ruleRemoveTargetById=921200;ARGS:/^(?:password|retype)$/,\
@@ -242,10 +250,11 @@ SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/
         ctl:ruleRemoveTargetById=942550;ARGS:/^(?:password|retype)$/,\
         ctl:ruleRemoveTargetById=944150;ARGS:/^(?:password|retype)$/"
 
-SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/Special:(?:CreateAccount|UserLogin)(?:/|$)" \
-    "id:900920,phase:1,pass,nolog,chain"
-    SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?Special:(?:CreateAccount|UserLogin)(?:/|$)" "chain"
-    SecRule &ARGS_GET:retype "@eq 0" \
+SecRule REQUEST_FILENAME "@rx ^/(?:w/)?index\.php$|^/(?:(?:w/)?index\.php|wiki)/[^/:]+:" \
+    "id:900920,phase:2,pass,nolog,chain"
+    SecRule REQUEST_FILENAME|ARGS_GET:title "@rx ^(?:/(?:(?:w/)?index\.php|wiki)/)?[^/:]+:" "chain"
+    SecRule &ARGS_GET:retype "@eq 0" "chain"
+    SecRule ARGS:authAction "@rx ^(?:create|login-continue)$" \
         "ctl:ruleRemoveTargetById=920270;ARGS:retype,\
         ctl:ruleRemoveTargetById=920540;ARGS:retype,\
         ctl:ruleRemoveTargetById=921200;ARGS:retype,\