Extension:TitleBlacklist

The TitleBlacklist extension allows wiki administrators to block the creation, movement and upload of pages, the title of which matches one or more regular expressions, as well as blocking creation of accounts with matching usernames.

Configuration

 * Array of title blacklist sources.
 * Should be in array( name => source description ) format. Defaults to an empty array.
 * Should be in array( name => source description ) format. Defaults to an empty array.


 * Sets the sources which may work as a username filter.
 * '*' is for all; false disables all.
 * If you want to limit it to particular sources, use array( source name 1, source name 2 ). This may be useful when you have shared account creation system in order to avoid blacklist fragmentation.
 * If you want to limit it to particular sources, use array( source name 1, source name 2 ). This may be useful when you have shared account creation system in order to avoid blacklist fragmentation.


 * When true, logs on Special:Log/titleblacklist all attempts of local account creation that match the blacklists. Defaults to  .  Note that even disabled, the log will still be visible for users groups with the   right.
 * When true, logs on Special:Log/titleblacklist all attempts of local account creation that match the blacklists. Defaults to  .  Note that even disabled, the log will still be visible for users groups with the   right.




 * Also blocks account created automatically that match the blacklists. Defaults to  .
 * Also blocks account created automatically that match the blacklists. Defaults to  .


 * Multiple block list sources :

The title block list can be gathered from multiple sources outside the local message. For configuring block list sources use code as described below:

See phab>phabricator:T113864</>|issue T113864 for further information.

Block list
The title block list is found on the blacklist>MediaWiki:Titleblacklist</>|MediaWiki:Titleblacklist page.

This page consists of regular expressions, each on a separate line, for example:

<pre style="overflow:auto;"> Foo <autoconfirmed|noedit|errmsg=blacklisted-testpage> #This page name is not allowed [Bb]ar #No one should create article about it .*pandora.* #This word is not allowed in any part of a page name

Each entry may also contain optional attributes, enclosed in  and separated with
 * autoconfirmed - also allows autoconfirmed users to perform such actions
 * casesensitive - do not ignore case when checking title for being put on the block list
 * noedit - users are also unable to edit these pages
 * moveonly - forbid moves but allow ordinary creation (rev:35163)
 * newaccountonly - forbid creation of matching usernames, but allow page creation (rev:38977)
 * reupload - allow reuploads of existing blocked files (rev:33656)
 * errmsg - the name of the message that should be displayed instead of standard

If the <tvar|AntiSpoof></> extension is installed, you can also use the <tvar|antispoof> </> attribute.

What is referred to here as regular expressions are not proper regular expressions, but rather subpatterns that are inserted into a hard-coded regular expression. i.e. the subpattern Foo from above would create a regular expression like /^Foo$/usi.

Underscores (" ") in regular expressions will be converted to spaces by the extension, because titles are matched against its text form ("Page title" instead of "Page_title").

Safe list
There is also a safe list at whitelist>MediaWiki:Titlewhitelist</>|MediaWiki:Titlewhitelist. The block list is applied first, then the safe list. So user input that matches an entry on the block list is blocked, except if it matches an entry on the safe list. You don't have to configure anything in LocalSettings.php in order to use the safe list. Some of the optional attributes listed above, for the block list, also work for the safe list, e.g. casesensitive.

Customizing

 * Warning messages

When an attempt to create a page is blocked due to a title being listed on the block list, a warning message is shown to the user. This can be customized via system messages
 * 1>MediaWiki:Titleblacklist-forbidden-edit</>|MediaWiki:Titleblacklist-forbidden-edit: for page creation and editing,
 * 2>MediaWiki:Titleblacklist-forbidden-move</>|MediaWiki:Titleblacklist-forbidden-move: for page moves,
 * 3>MediaWiki:Titleblacklist-forbidden-upload</>|MediaWiki:Titleblacklist-forbidden-upload: for image uploads.
 * 4>MediaWiki:Titleblacklist-forbidden-new-account</>|MediaWiki:Titleblacklist-forbidden-new-account: for new accounts

Custom messages can be defined by using the  attribute.

Conceptual overview
The username for new accounts will be regarded by this extension differently to the way it regards new articles. This extension will prepend "User:" (or its localized equivalent) to the string that a user enters at  on the create account page. So when this extension is performing matches with your Regex's, as found on blacklist>MediaWiki:Titleblacklist</>|MediaWiki:Titleblacklist or whitelist>MediaWiki:Titlewhitelist</>|MediaWiki:Titlewhitelist, it will match against "User:" +.

For example, imagine you want to block "jill" as a new user. Imagine you had a block list regex "jill.* " and a user enters "jill" as the username on the create account page. This will pass as the comparison this extension will make will be between "jill.*" (the regex) and "User:jill" (the constructed input string). These don't match and so "jill" is allowed (and you probably didn't intend this). To effect the intended block use a regex like ".*jill.* " or "User:jill.* " on blacklist>MediaWiki:Titleblacklist</>|MediaWiki:Titleblacklist.

If you want to block all users except for all those that do match a regex then block all users in blacklist>MediaWiki:Titleblacklist</>|MediaWiki:Titleblacklist and write the permissible regex in the whitelist>MediaWiki:Titlewhitelist</>|MediaWiki:Titlewhitelist.

How to
If you would like to force all usernames, during account creation, to consist of exactly two names, space separated, with each name capitalized then do the following:

1. Install TitleBlacklist.

2. Add the following to your <tvar|localsettings></>

3. In <tvar|url>https://www.example.com/mywiki/MediaWiki:Titleblacklist</> add

4. In <tvar|url>https://www.example.com/mywiki/MediaWiki:Titlewhitelist</> add

5. In <tvar|url>https://www.example.com/mywiki/MediaWiki:Titleblacklist-forbidden-new-account edit</>

<pre style="overflow:auto;"> The user name "$2" has been blocked from creation. It matches the following block list entry:.

Please use a real name for the user name. User names need to be comprised of two names separated by a space. Each name must be capitalized.

E.g.:
 * "Mary Smith". OK.
 * "MarySmith". Invalid.
 * "Mary smith". Invalid.
 * "marysmith". Invalid.

User name creation (and article creation) blocking rules are controlled by blacklist>MediaWiki:Titleblacklist</>|MediaWiki:Titleblacklist and whitelist>MediaWiki:Titlewhitelist</>|MediaWiki:Titlewhitelist. This message can be customized at forbid>MediaWiki:Titleblacklist-forbidden-new-account</>|MediaWiki:Titleblacklist-forbidden-new-account

Testing for matches
The API module <tvar|titleblacklist>action=titleblacklist</> can be used to test a title and action (e.g. edit, create, new-account) against the block list. Users with the 'tboverride' right should be sure to supply the <tvar|tbnooverride> </> parameter.

For example, if the block list contained the filter:

.*(.)\1{10}.* <newaccountonly|errmsg=titleblacklist-forbidden-new-account-invalid> # Disallows eleven or more of the same character repeated in usernames

you could use an API request like {{ApiEx ",       "message": "titleblacklist-forbidden-new-account-invalid",        "line": ".*(.)\1{10}.* &lt;newaccountonly|errmsg=titleblacklist-forbidden-new-account-invalid&gt; # Disallows eleven or more of the same character repeated in usernames"    } } }}
 * p1=action=titleblacklist
 * p2=tbtitle=AAAAAAAAAAA
 * p3=tbaction=new-account
 * p4=tbnooverride=1
 * result=

If scribunto>Extension:Scribunto</>|Scribunto is installed, this extension allows for testing if particular titles and actions will match an entry in the block list using the <tvar|test> </> function. If a match is found, the details for the matched entry are returned.

For example, if the block list contained the filter:

.*(.)\1{10}.* <newaccountonly|errmsg=titleblacklist-forbidden-new-account-invalid> # Disallows eleven or more of the same character repeated in usernames

running the function:

would return the following table containing details about the matched entry:

Resources on regular expressions

 * Brief Introduction to Regular Expressions
 * <tvar|regex>https://web.archive.org/web/20050213032350/http://etext.lib.virginia.edu/services/helpsheets/unix/regex.html</>
 * The 30 Minute Regex. Tutorial
 * <tvar|tutorial>http://www.codeproject.com/Articles/9099/The-Minute-Regex-Tutorial</>
 * PHP: PCRE regex syntax, the syntax of regular expressions used by PHP &mdash; and therefore this extension
 * https://php.net/reference.pcre.pattern.syntax