fixed the vulnerability further

This commit is contained in:
vecchiotom
2018-04-27 21:00:07 +02:00
parent dd859db58f
commit a0a0cbc9a5
+37 -18
View File
@@ -57,26 +57,45 @@ end)
RegisterServerEvent('esx_weashop:buyItem')
AddEventHandler('esx_weashop:buyItem', function(itemName, price, zone)
local _source = source
local xPlayer = ESX.GetPlayerFromId(source)
local account = xPlayer.getAccount('black_money')
if price >= 0 then
if zone=="BlackWeashop" then
if account.money >= price then
xPlayer.removeAccountMoney('black_money', price)
xPlayer.addWeapon(itemName, 42)
TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName))
else
TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black'))
MySQL.Async.fetchAll('SELECT * FROM weashops',
{}, function(result)
local shopItems = {}
for i=1, #result, 1 do
if shopItems[result[i].name] == nil then
shopItems[result[i].name] = {}
end
else
if xPlayer.get('money') >= price then
xPlayer.removeMoney(price)
xPlayer.addWeapon(itemName, 42)
TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName))
table.insert(shopItems[result[i].name], {
name = result[i].item,
price = result[i].price,
label = ESX.GetWeaponLabel(result[i].item)
})
end
local _source = source
local xPlayer = ESX.GetPlayerFromId(source)
local account = xPlayer.getAccount('black_money')
if price == shopItems[itemName].price then
if zone=="BlackWeashop" then
if account.money >= price then
xPlayer.removeAccountMoney('black_money', price)
xPlayer.addWeapon(itemName, 42)
TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName))
else
TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black'))
end
else
TriggerClientEvent('esx:showNotification', _source, _U('not_enough'))
if xPlayer.get('money') >= price then
xPlayer.removeMoney(price)
xPlayer.addWeapon(itemName, 42)
TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName))
else
TriggerClientEvent('esx:showNotification', _source, _U('not_enough'))
end
end
end
end
end)
end)