starred/esx_core-esx-framework
1
0
Fork 0
mirror of https://github.com/esx-framework/esx_core.git synced 2026-09-04 16:23:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed security issue

Browse Source
This commit is contained in:
ElPumpo
2020-02-17 21:57:00 +01:00
parent 167c14c4b7
commit b1fc7b392e
1 changed files with 38 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/main.lua
+38 -38
View File
@@ -322,52 +322,52 @@ ESX.RegisterServerCallback('esx_vehicleshop:giveBackVehicle', function(source, c
end) end)
ESX.RegisterServerCallback('esx_vehicleshop:resellVehicle', function(source, cb, plate, model) ESX.RegisterServerCallback('esx_vehicleshop:resellVehicle', function(source, cb, plate, model)
local resellPrice local xPlayer, resellPrice = ESX.GetPlayerFromId(source)
-- calculate the resell price if xPlayer.job.name == 'cardealer' then
for i=1, #vehicles, 1 do -- calculate the resell price
if GetHashKey(vehicles[i].model) == model then for i=1, #vehicles, 1 do
resellPrice = ESX.Math.Round(vehicles[i].price / 100 * Config.ResellPercentage) if GetHashKey(vehicles[i].model) == model then
break resellPrice = ESX.Math.Round(vehicles[i].price / 100 * Config.ResellPercentage)
break
end
end end
end
if not resellPrice then if not resellPrice then
print(('[esx_vehicleshop] [^3WARNING^7] %s attempted to sell an unknown vehicle!'):format(GetPlayerIdentifiers(source)[1])) print(('[esx_vehicleshop] [^3WARNING^7] %s attempted to sell an unknown vehicle!'):format(xPlayer.identifier))
cb(false) cb(false)
else else
MySQL.Async.fetchAll('SELECT * FROM rented_vehicles WHERE plate = @plate', { MySQL.Async.fetchAll('SELECT * FROM rented_vehicles WHERE plate = @plate', {
['@plate'] = plate ['@plate'] = plate
}, function(result) }, function(result)
if result[1] then -- is it a rented vehicle? if result[1] then -- is it a rented vehicle?
cb(false) -- it is, don't let the player sell it since he doesn't own it cb(false) -- it is, don't let the player sell it since he doesn't own it
else else
local xPlayer = ESX.GetPlayerFromId(source) MySQL.Async.fetchAll('SELECT * FROM owned_vehicles WHERE owner = @owner AND @plate = plate', {
['@owner'] = xPlayer.identifier,
['@plate'] = plate
}, function(result)
if result[1] then -- does the owner match?
local vehicle = json.decode(result[1].vehicle)
MySQL.Async.fetchAll('SELECT * FROM owned_vehicles WHERE owner = @owner AND @plate = plate', { if vehicle.model == model then
['@owner'] = xPlayer.identifier, if vehicle.plate == plate then
['@plate'] = plate xPlayer.addMoney(resellPrice)
}, function(result) RemoveOwnedVehicle(plate)
if result[1] then -- does the owner match? cb(true)
local vehicle = json.decode(result[1].vehicle) else
print(('[esx_vehicleshop] [^3WARNING^7] %s attempted to sell an vehicle with plate mismatch!'):format(xPlayer.identifier))
if vehicle.model == model then cb(false)
if vehicle.plate == plate then end
xPlayer.addMoney(resellPrice)
RemoveOwnedVehicle(plate)
cb(true)
else else
print(('[esx_vehicleshop] [^3WARNING^7] %s attempted to sell an vehicle with plate mismatch!'):format(xPlayer.identifier)) print(('[esx_vehicleshop] [^3WARNING^7] %s attempted to sell an vehicle with model mismatch!'):format(xPlayer.identifier))
cb(false) cb(false)
end end
else
print(('[esx_vehicleshop] [^3WARNING^7] %s attempted to sell an vehicle with model mismatch!'):format(xPlayer.identifier))
cb(false)
end end
end end)
end) end
end end)
end) end
end end
end) end)