CVE-2021-32722: Uncontrolled Resource Consumption (CWE-400)
value: GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulnerability. A large amount of page moves within a short space of time could overwhelm Database servers due to improper handling of load balancing and a lack of an appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki level or via PoolCounter / MySQL is enabled. A patch is available in version 48be7adb70568e20e961ea1cb70904454a671b1d.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2021-06-28T20:15Z
Repository: https://github.com/miraheze/GlobalNewFiles
Language: PHP
Files changed: extension.json, includes/GlobalNewFilesHooks.php
Commit date: 2021-07-19 16:20:42 -0600
Commit message: Use PageMoveComplete hook (#17)


Diff: diff --git a/extension.json b/extension.json
index e1b7b8b..f940a35 100644
--- a/extension.json
+++ b/extension.json
@@ -51,12 +51,12 @@
 			"GlobalNewFilesHooks::onLoadExtensionSchemaUpdates"
 		],
 		"FileDeleteComplete": [
 			"GlobalNewFilesHooks::onFileDeleteComplete"
 		],
-		"TitleMoveComplete": [
-			"GlobalNewFilesHooks::onTitleMoveComplete"
+		"PageMoveComplete": [
+			"GlobalNewFilesHooks::onPageMoveComplete"
 		],
 		"UploadComplete": [
 			"GlobalNewFilesHooks::onUploadComplete"
 		]
 	},
diff --git a/includes/GlobalNewFilesHooks.php b/includes/GlobalNewFilesHooks.php
index ecc6c95..51f5315 100644
--- a/includes/GlobalNewFilesHooks.php
+++ b/includes/GlobalNewFilesHooks.php
@@ -17,14 +17,17 @@ class GlobalNewFilesHooks {
 		JobQueueGroup::singleton()->push(
 			new GlobalNewFilesDeleteJob( $file->getTitle(), [] )
 		);
 	}
 
-	public static function onTitleMoveComplete( $title, $newTitle, $user, $oldid, $newid, $reason, $revision ) {
-		if ( $title->inNamespace( NS_FILE ) ) {
+	public static function onPageMoveComplete( $old, $new, $userIdentity, $pageid, $redirid, $reason, $revision ) {
+		$oldTitle = Title::newFromLinkTarget( $old );
+		$newTitle = Title::newFromLinkTarget( $new );
+
+		if ( $oldTitle->inNamespace( NS_FILE ) ) {
 			JobQueueGroup::singleton()->push(
-				new GlobalNewFilesMoveJob( [ 'oldtitle' => $title, 'newtitle' => $newTitle ] )
+				new GlobalNewFilesMoveJob( [ 'oldtitle' => $oldTitle, 'newtitle' => $newTitle ] )
 			);
 		}
 	}
 
 	public static function onLoadExtensionSchemaUpdates( DatabaseUpdater $updater ) {

Vulnerable code: 		"TitleMoveComplete": [
			"GlobalNewFilesHooks::onTitleMoveComplete"
	public static function onTitleMoveComplete( $title, $newTitle, $user, $oldid, $newid, $reason, $revision ) {
		if ( $title->inNamespace( NS_FILE ) ) {
				new GlobalNewFilesMoveJob( [ 'oldtitle' => $title, 'newtitle' => $newTitle ] )
Fixed code: 		"PageMoveComplete": [
			"GlobalNewFilesHooks::onPageMoveComplete"
	public static function onPageMoveComplete( $old, $new, $userIdentity, $pageid, $redirid, $reason, $revision ) {
		$oldTitle = Title::newFromLinkTarget( $old );
		$newTitle = Title::newFromLinkTarget( $new );

		if ( $oldTitle->inNamespace( NS_FILE ) ) {
				new GlobalNewFilesMoveJob( [ 'oldtitle' => $oldTitle, 'newtitle' => $newTitle ] )