CheckRegistrationEmailDomains

This is a MediaWiki extension which only allows account registrations from email domains listed in a configurable allowlist.

Installation

• Download the extension to your extensions/ directory, i.e. via Git:

  cd extensions/
  git clone https://codeberg.org/chdorner/CheckRegistrationEmailDomains.git
  

• Enable the extension in your LocalSettings.php:

  wfLoadExtension( 'CheckRegistrationEmailDomains' );
  

Configuration

Email domains

By default, the list of allowed email domains is empty, denying any registration attempt. To enable certain email domains, add this to your LocalSettings.php:

$wgCheckRegistrationEmailDomainsAllowlist = [ 'example.com', 'example.org' ];

Require Email

MediaWiki allows to create accounts without email, when enabling this extension it defaults to requiring emails to be provided when registering.

A reason to disable this could be if you would want a publicly readable wiki that requires user accounts with emails from specific domains to edit.

You can disable this functionality by adding this to your LocalSettings.php:

$wgCheckRegistrationEmailDomainsRequireEmail = false;

To require email addresses for all new registrations, either don't include this configuration option at all, or set it to true:

$wgCheckRegistrationEmailDomainsRequireEmail = true;

Recipes

Fully private wiki

The following configuration is a starting point for getting an authenticated read and write Wiki, only allowing user registrations from example.org email domains:

# send confirmation emails
$wgEmailAuthentication = true;
# only allow user registrations from example.org email domains
wfLoadExtension( 'CheckRegistrationEmailDomains' );
$wgCheckRegistrationEmailDomainsAllowlist = [ 'example.org' ];
# automatically promote users confirming their accounts to the `emailconfirmed` group
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
# permissions
# - disable all reading restrictions on the following pages
$wgWhitelistRead = [
 'Special:CreateAccount', # to fill out the registration form
 'Spezial:Benutzerkonto anlegen', # Special:CreateAccount for each language, here: German
 'Special:ConfirmEmail', # when clicking on the confirmation link from the email
 'Spezial:E-Mail bestätigen', # Special:ConfirmEmail for each language, here: German
 'MediaWiki:Common.css', # consistent CSS for all users
 'MediaWiki:Common.js', # consistent JS for all users
];
# - allow anonymous users to create accounts
$wgGroupPermissions['*']['createaccount'] = true;
# - disable editing for anonymous and unconfirmed users
# - also requires email to be filled out in registration form
$wgEmailConfirmToEdit = true;
# - disable read for anonymous users
$wgGroupPermissions['*']['read'] = false;
# - disable read for the `user` group (i.e. unconfirmed users)
$wgGroupPermissions['user']['read'] = false;
# - enable read/write for the `emailconfirmed` group
$wgGroupPermissions['emailconfirmed']['read'] = true;
$wgGroupPermissions['emailconfirmed']['edit'] = true;
# - always enable read/write for the sysop, regardless of confirmation status
$wgGroupPermissions['sysop']['read'] = true;
$wgGroupPermissions['sysop']['edit'] = true;

The post-registration page is by default quite vague about what needs to happen next. Pairing this with taking away the read permissions of unconfirmed users results in a confusing experience. A way to alleviate this is by customising the message shown after successfully registering by editing the MediaWiki:Welcomecreation-msg page. For example, it could say:

Your account has been created.
You can change your {{SITENAME}} [[Special:Preferences|preferences]] if you wish.
Please confirm your email first, until then your account is locked.

Public read, private write

The following configuration is a starting point for a Wiki that is publicly readable, but only allows authenticated user accounts for writing, and again, requiring the email domains to be from example.org:

# send confirmation emails
$wgEmailAuthentication = true;
# only allow user registrations from example.org email domains
wfLoadExtension( 'CheckRegistrationEmailDomains' );
$wgCheckRegistrationEmailDomainsAllowlist = [ 'example.org' ];
# require email to register
$wgEmailConfirmToEdit = true;