Extension:TitleBlacklist

---

 Note: This extension is bundled with MediaWiki 1.21 and above. Thus you do not have to download it again.

MediaWiki extensions manual

TitleBlacklist Release status: stable
Implementation	User rights, API
Description	Blocks the creation of pages matching a regular expression blacklist
Author(s)	Victor Vasiliev (VasilievVVtalk)
Latest version	1.5.0 (2014-03-29)
MediaWiki	1.20+
PHP	5.3+
Database changes	No
License	GNU General Public License 2.0 or later
Download	Download snapshot (Git master) Git [?]: repo summary browse file tree commit history code review
Parameters $wgTitleBlacklistSources $wgTitleBlacklistUsernameSources $wgTitleBlacklistLogHits $wgTitleBlacklistCaching $wgTitleBlacklistBlockAutoAccountCreation
Added rights tboverride tboverride-account titleblacklistlog
Hooks used getUserPermissionsErrorsExpensive AbortMove AbortNewAccount AbortAutoAccount EditFilter ArticleSaveComplete UserCreateForm UnitTestsList ScribuntoExternalLibraries
Translate the TitleBlacklist extension if it is available at translatewiki.net
Check usage and version matrix; code metrics
Issues:	Open tasks · Report a bug

The TitleBlacklist extension allows wiki administrators to block the creation, movement and upload of pages, the title of which matches one or more regular expressions, as well as blocking creation of accounts with matching usernames.

Installation

• Download and place the file(s) in a directory called TitleBlacklist in your extensions/ folder.
• Add the following code at the bottom of your LocalSettings.php:

wfLoadExtension( 'TitleBlacklist' );

• Configure blacklist sources (see below)
• Y Done - Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

To users running MediaWiki 1.24 or earlier:

The instructions above describe the new way of installing extensions using wfLoadExtension(), since MediaWiki 1.25. If you need to install this extension in earlier versions, instead of wfLoadExtension( 'TitleBlacklist' );, you need to use:

require_once "$IP/extensions/TitleBlacklist/TitleBlacklist.php";

 Note: By default it only affects non-sysop users. To make it default for all use $wgGroupPermissions['sysop']['tboverride'] = false;.

Configuration

• $wgTitleBlacklistSources:

Array of title blacklist sources.

Should be in array( name => source description ) format.

• $wgTitleBlacklistUsernameSources:

Sets the sources which may work as a username filter.

'*' is for all; false disables all.

If you want to limit it to particular sources, use array( source name 1, source name 2 ). This may be useful when you have shared account creation system in order to avoid blacklist fragmentation.

• $wgTitleBlacklistLogHits: Hide "titleblacklist" from Special:Log
• $wgTitleBlacklistCaching: ?
• $wgTitleBlacklistBlockAutoAccountCreation: Disable the filtering of autocreation

Multiple blacklist sources

MediaWiki version:

≤ 1.25

Title blacklist can be gathered from multiple sources except local message. For configuring blacklist sources use code as described below:

$wgTitleBlacklistSources = array(
    array(
         'type' => TBLSRC_LOCALPAGE,
         'src'  => 'MediaWiki:Titleblacklist',
    ),
    array(
         'type' => TBLSRC_URL,
         'src'  => 'https://meta.wikimedia.org/w/index.php?title=Title_blacklist&action=raw',
    ),
    array(
         'type' => TBLSRC_FILE,
         'src'  => '/home/wikipedia/blacklists/titles',
    ),
);

• Use TBLSRC_LOCALPAGE for using local page as title blacklist
• Use TBLSRC_URL for using external URL as title blacklist
• Use TBLSRC_FILE for using file as title blacklist

Multiple blacklist sources (MW ≥ 1.26)

MediaWiki version:

≥ 1.26

Title blacklist can be gathered from multiple sources except local message. For configuring blacklist sources use code as described below:

wfLoadExtension( 'TitleBlacklist' );
$wgTitleBlacklistSources = array(
    array(
         'type' => 'localpage',
         'src'  => 'MediaWiki:Titleblacklist',
    ),
    array(
         'type' => 'url',
         'src'  => 'https://meta.wikimedia.org/w/index.php?title=Title_blacklist&action=raw',
    ),
    array(
         'type' => 'file',
         'src'  => '/home/wikipedia/blacklists/titles',
    ),
);

The reason is that the TBLSRC_... constants are not longer defined when using the new extension registration! See issue T113864 for further information.

Editing the blacklist

The title blacklist is found on the MediaWiki:Titleblacklist page.

This page consists of regular expressions, each on a separate line, for example:

Foo <autoconfirmed|noedit|errmsg=blacklisted-testpage> 
[Bb]ar #No one should create article about it

Each entry may also contain optional attributes, enclosed in <> and separated with |

• autoconfirmed - only autoconfirmed users are able to create/upload/move such pages
• casesensitive - don't ignore case when checking title for being blacklisted
• noedit - users are also unable to edit this article
• moveonly - forbid moves but allow ordinary creation (rev:35163)
• newaccountonly - forbid creation of matching usernames, but allow page creation (rev:38977)
• reupload - allow reuploads of existing blacklisted files (rev:33656)
• errmsg - the name of the message that should be displayed instead of standard

What is referred to here as regular expressions are not proper regular expressions, but rather subpatterns that are inserted into a hard-coded regular expression. i.e. the subpattern Foo from above would create a regular expression like /^Foo$/usi.

Underscores ("_") in regular expressions will be converted to spaces by the extension, because titles are matched against its text form ("Page title" instead of "Page_title").

Whitelist

There is also a whitelist at MediaWiki:Titlewhitelist. The blacklist is applied first, then the whitelist. So user input that matches an entry on the blacklist is blocked, except if it matches an entry on the whitelist. You don't have to configure anything in LocalSettings.php in order to use the whitelist. Some of the optional attributes listed above, for the blacklist, also work for the whitelist, e.g. casesensitive.

Customising warning messages

When an attempt to create a page is blocked due to a blacklisted title, a warning message is shown to the user. This can be customized via system messages

• MediaWiki:Titleblacklist-forbidden-edit: for page creation and editing,
• MediaWiki:Titleblacklist-forbidden-move: for page moves,
• MediaWiki:Titleblacklist-forbidden-upload: for image uploads.
• MediaWiki:Titleblacklist-forbidden-new-account: for new accounts

Custom messages can be defined by using the errmsg attribute.

Using TitleBlacklist to control user account creation

Conceptual overview

The username for new accounts will be regarded by Titleblacklist differently to the way it regards new articles. Titleblacklist will prepend "User:" (or its localized equivalent) to the string that a user enters at Username on the create account page. So when Titleblacklist is performing matches with your Regex's, as found on MediaWiki:Titleblacklist or MediaWiki:Titlewhitelist, it will match against "User:" + <userinput>.

For example, imagine you want to block "jill" as a new user. Imagine you had a blacklist regex "jill.* <newaccountonly>" and a user enters "jill" as the username on the create account page. This will pass as the comparison Titleblacklist will make will be between "jill.*" (the regex) and "User:jill" (the constructed input string). These don't match and so "jill" is allowed (and you probably didn't intend this). To effect the intended block use a regex like ".*jill.* <newaccountonly>" or "User:jill.* <newaccountonly>" on MediaWiki:Titleblacklist.

If you want to block all users except for all those that do match a regex then block all users in MediaWiki:Titleblacklist and write the permissible regex in the MediaWiki:Titlewhitelist.

A working example

If you would like to force all usernames, during account creation, to consist of exactly two names, space separated, with each name capitalized then do the following:

1. Install TitleBlacklist.

2. Add the following to your LocalSettings.php

require_once( "{$IP}/extensions/TitleBlacklist/TitleBlacklist.php" );
// Apply to all, not just anonymous users.
$wgGroupPermissions['sysop']['tboverride'] = false; 
$wgTitleBlacklistSources = array(
  array(
    'type' => TBLSRC_LOCALPAGE,
    'src'  => 'MediaWiki:Titleblacklist'
  )
);

3. In https://www.example.com/mywiki/MediaWiki:Titleblacklist add

# Block all user accounts, and only permit those that match the MediaWiki:Titlewhitelistregex 
.* <newaccountonly>

4. In https://www.example.com/mywiki/MediaWiki:Titlewhitelist add

# Only allow two names, separated by a space, with each name capitalized. E.g "Fred Mew" OK, "Fred mew" fails, "Fredmew" fails.
# Depends on .* <newaccountonly> in blacklist
User:[A-Z][a-z]+\s[A-Z][a-z]+ <casesensitive>

5. In https://www.example.com/mywiki/MediaWiki:Titleblacklist-forbidden-new-account edit

The user name "$2" has been blocked from creation. It matches the following blacklist entry: <code>$1</code>.

Please use a real name for the user name. User names need to be comprised of two names separated by a space. Each name must be capitalized.

E.g.:
* "Mary Smith". OK.
* "MarySmith". Invalid.
* "Mary smith". Invalid.
* "marysmith". Invalid.

User name creation (and article creation) blocking rules are controlled by MediaWiki:Titleblacklist and MediaWiki:Titlewhitelist. This message can be customized at MediaWiki:Titleblacklist-forbidden-new-account

Testing for matches

If Scribunto is installed, TitleBlacklist allows for testing if particular titles and actions will match an entry in the blacklist using the mw.ext.TitleBlacklist.test function. If a match is found, the details for the matched entry are returned.

For example, if the blacklist contained the filter:

.*(.)\1{10}.* <newaccountonly|errmsg=titleblacklist-forbidden-new-account-invalid> # Disallows eleven or more of the same character repeated in usernames

running the function:

mw.ext.TitleBlacklist.test("new-account", "AAAAAAAAAAA")

would return the following table containing details about the matched entry:

{
	custommessage = "titleblacklist-forbidden-new-account-invalid",
	message = "titleblacklist-forbidden-new-account-invalid",
	params = {
		errmsg = "titleblacklist-forbidden-new-account-invalid",
		newaccountonly = true
	},
	raw = " .*(.)\1{10}.* <newaccountonly|errmsg=titleblacklist-forbidden-new-account-invalid> # Disallows eleven or more of the same character repeated in usernames",
	regex = ".*(.)\1{10}.*",
	version = 3
}

Resources on regular expressions

• Brief Introduction to Regular Expressions

  https://web.archive.org/web/20050213032350/http://etext.lib.virginia.edu/services/helpsheets/unix/regex.html

• The 30 Minute Regex. Tutorial

  http://www.codeproject.com/Articles/9099/The-Minute-Regex-Tutorial

• PHP: PCRE regex syntax, the syntax of regular expressions used by PHP — and therefore this extension

  http://php.net/manual/en/reference.pcre.pattern.syntax.php

See also

• Combating spam and combating vandalism.