Manual:$wgCopyUploadsDomains

Details
The domains in the whitelist can include wildcard characters (*) in place of any of the domain levels, e.g. '*.flickr.com' or 'upload.*.gov.uk'.

If this array is empty (per the default), all domains are accepted.

Example usage
This example setup will allow all autoconfirmed users to upload by URL, via Special:Upload or the API, from Flickr and some UK Government websites only.

Add to the bottom of your :