BLACKLISTED_PROJECTS doesn't blacklist user names when using USER_NAMESPACE = True and the internal authenticator. Repos are created in /srv/git/repos/docs/ for the 'docs' user, for example. (Note that 'docs' isn't in the blacklist, but might belong there.)

For the 'requests' user, creating a repo causes this error:

 Your task failed: Remote hook declined the push: Traceback (most recent call last): File "hooks/pre-receive", line 36, in <module> run_hook_file(hooktype) File "/usr/local/lib/python3.6/dist-packages/pagure-5.8.1-py3.6.egg/pagure/hooks/__init__.py", line 535, in run_hook_file "%s - %s" % (repotype, username, namespace, repo) Exception: Not able to find the project corresponding to: requests - None - None - test

Repos are created for the 'static' user, but visiting that repo leads to a 404 page.

It might be wise for third party authenticators to blacklist these user names, but enforcing it centrally might be very helpful.

Thanks : )