Change 758100 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/core@master] Allow managing upload-by-url allowlist as a system message

https://gerrit.wikimedia.org/r/758100

Hi @Majavah, this is sooo useful :) Thanks for coming up with this brilliant idea and uploading the patch!

Can you guess when this feature will be available for Commons admins? I ask this question because I have a bunch of url allowlisting tasks such as T300375: Add researcharchive.calacademy.org to the wgCopyUploadsDomains allowlist of Wikimedia Commons and I want to know if I can arrange for their deployment today or I had better wait. Thanks again

In T300407#7662376, @4nn1l2 wrote:

[...]
Can you guess when this feature will be available for Commons admins? I ask this question because I have a bunch of url allowlisting tasks such as T300375: Add researcharchive.calacademy.org to the wgCopyUploadsDomains allowlist of Wikimedia Commons and I want to know if I can arrange for their deployment today or I had better wait. Thanks again

I'm not Majavah, but I have some experience with new features. I think "in 3 months" would be a realistic estimate (but, things happen, and it can be delayed for unexpected reasons).

In T300407#7694934, @Urbanecm wrote:

In T300407#7662376, @4nn1l2 wrote:

[...]
Can you guess when this feature will be available for Commons admins? I ask this question because I have a bunch of url allowlisting tasks such as T300375: Add researcharchive.calacademy.org to the wgCopyUploadsDomains allowlist of Wikimedia Commons and I want to know if I can arrange for their deployment today or I had better wait. Thanks again

I'm not Majavah, but I have some experience with new features. I think "in 3 months" would be a realistic estimate (but, things happen, and it can be delayed for unexpected reasons).

In another words: "somtimes after someone +2's the attached patch". I've asked some people to review it, but can't force anyone to do so.

Would it be possible to have it as a JSON page?

Change 758100 merged by jenkins-bot:

[mediawiki/core@master] Allow managing upload-by-url allowlist as a system message

https://gerrit.wikimedia.org/r/758100

Hi @4nn1l2 and others! The code change was merged to mediawiki/core a while back now, so this is now possible with a simple config change. Do you have preferences on when to enable that config switch? I'm happy to copy the current list from the config repo to Commons or leave that to you if you prefer that.

Hi @Majavah, I have posted a notice on local VP. There is a question: "would this also work with the MediaWiki Upload Wizard as it currently does for Flickr?" Thanks!

Also, I dumped the allowlist inside InitialiseSettings.php to an on-wiki page, please check if the syntax is correct.

Change 793766 had a related patch set uploaded (by Stang; author: Stang):

[operations/mediawiki-config@master] commonswiki: Enable wgCopyUploadAllowOnWikiDomainConfig

https://gerrit.wikimedia.org/r/793766

Change 793766 merged by jenkins-bot:

[operations/mediawiki-config@master] commonswiki: Enable wgCopyUploadAllowOnWikiDomainConfig

https://gerrit.wikimedia.org/r/793766

Mentioned in SAL (#wikimedia-operations) [2022-05-23T20:13:16Z] <cjming@deploy1002> Synchronized wmf-config/InitialiseSettings.php: Config: [[gerrit:793766|commonswiki: Enable wgCopyUploadAllowOnWikiDomainConfig (T300407)]] (duration: 00m 52s)

re https://lists.wikimedia.org/hyperkitty/list/sitereq-l@lists.wikimedia.org/thread/DEE7HHID26YNKYQKA4QQ4WW5YHURU7CB/

• Why do we even have an allowlist for upload-by-url? I presume this is

to make it harder to upload a large amount of non-free files, but I'm
curious if there are any other reasons that I'm not aware of.

If memory serves, there was some paranoia around someone finding a zero-day in url-downloader.wikimedia.org and maybe SSRF. I remember thinking the worry was a bit overblown at the time.

Ah found it: T65961#679911 was essentially what lead to the restriction.