From dd859db58fac8b26835b450ad855a0633a1c6437 Mon Sep 17 00:00:00 2001 From: vecchiotom Date: Fri, 27 Apr 2018 20:48:25 +0200 Subject: [PATCH 1/4] fixed vulnerability --- server/main.lua | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/server/main.lua b/server/main.lua index 672e113d..69cf2bc6 100644 --- a/server/main.lua +++ b/server/main.lua @@ -60,22 +60,23 @@ AddEventHandler('esx_weashop:buyItem', function(itemName, price, zone) local _source = source local xPlayer = ESX.GetPlayerFromId(source) local account = xPlayer.getAccount('black_money') - - if zone=="BlackWeashop" then - if account.money >= price then - xPlayer.removeAccountMoney('black_money', price) - xPlayer.addWeapon(itemName, 42) - TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + if price >= 0 then + if zone=="BlackWeashop" then + if account.money >= price then + xPlayer.removeAccountMoney('black_money', price) + xPlayer.addWeapon(itemName, 42) + TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black')) + end else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black')) - end - else - if xPlayer.get('money') >= price then - xPlayer.removeMoney(price) - xPlayer.addWeapon(itemName, 42) - TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) - else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) + if xPlayer.get('money') >= price then + xPlayer.removeMoney(price) + xPlayer.addWeapon(itemName, 42) + TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) + end end end end) From a0a0cbc9a533374d8161031ec190920da518a710 Mon Sep 17 00:00:00 2001 From: vecchiotom Date: Fri, 27 Apr 2018 21:00:07 +0200 Subject: [PATCH 2/4] fixed the vulnerability further --- server/main.lua | 55 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 18 deletions(-) diff --git a/server/main.lua b/server/main.lua index 69cf2bc6..03ec327d 100644 --- a/server/main.lua +++ b/server/main.lua @@ -57,26 +57,45 @@ end) RegisterServerEvent('esx_weashop:buyItem') AddEventHandler('esx_weashop:buyItem', function(itemName, price, zone) - local _source = source - local xPlayer = ESX.GetPlayerFromId(source) - local account = xPlayer.getAccount('black_money') - if price >= 0 then - if zone=="BlackWeashop" then - if account.money >= price then - xPlayer.removeAccountMoney('black_money', price) - xPlayer.addWeapon(itemName, 42) - TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) - else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black')) + MySQL.Async.fetchAll('SELECT * FROM weashops', + {}, function(result) + local shopItems = {} + for i=1, #result, 1 do + + if shopItems[result[i].name] == nil then + shopItems[result[i].name] = {} end - else - if xPlayer.get('money') >= price then - xPlayer.removeMoney(price) - xPlayer.addWeapon(itemName, 42) - TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + + table.insert(shopItems[result[i].name], { + name = result[i].item, + price = result[i].price, + label = ESX.GetWeaponLabel(result[i].item) + }) + + end + + local _source = source + local xPlayer = ESX.GetPlayerFromId(source) + local account = xPlayer.getAccount('black_money') + if price == shopItems[itemName].price then + if zone=="BlackWeashop" then + if account.money >= price then + xPlayer.removeAccountMoney('black_money', price) + xPlayer.addWeapon(itemName, 42) + TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black')) + end else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) + if xPlayer.get('money') >= price then + xPlayer.removeMoney(price) + xPlayer.addWeapon(itemName, 42) + TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) + end end end - end + + end) end) From 06c192e5293aea9ea96e57fb7996046cd3888588 Mon Sep 17 00:00:00 2001 From: vecchiotom Date: Fri, 27 Apr 2018 21:08:29 +0200 Subject: [PATCH 3/4] code clean up --- server/main.lua | 66 ++++++++++++++++++++----------------------------- 1 file changed, 27 insertions(+), 39 deletions(-) diff --git a/server/main.lua b/server/main.lua index 03ec327d..22d0fa21 100644 --- a/server/main.lua +++ b/server/main.lua @@ -15,6 +15,26 @@ if Config.EnableLicense == true then end) end +function LoadShopItems(cb) + MySQL.Async.fetchAll('SELECT * FROM weashops', + {}, function(result) + local shopItems = {} + for i=1, #result, 1 do + + if shopItems[result[i].name] == nil then + shopItems[result[i].name] = {} + end + + table.insert(shopItems[result[i].name], { + name = result[i].item, + price = result[i].price, + label = ESX.GetWeaponLabel(result[i].item) + }) + cb(shopItems) + end + end) +end + RegisterServerEvent('esx_weashop:buyLicense') AddEventHandler('esx_weashop:buyLicense', function () local _source = source @@ -32,49 +52,14 @@ AddEventHandler('esx_weashop:buyLicense', function () end) ESX.RegisterServerCallback('esx_weashop:requestDBItems', function(source, cb) - MySQL.Async.fetchAll('SELECT * FROM weashops', - {}, function(result) - local shopItems = {} - for i=1, #result, 1 do - - if shopItems[result[i].name] == nil then - shopItems[result[i].name] = {} - end - - table.insert(shopItems[result[i].name], { - name = result[i].item, - price = result[i].price, - label = ESX.GetWeaponLabel(result[i].item) - }) - - end - - cb(shopItems) - - end - ) + LoadShopItems(cb) end) RegisterServerEvent('esx_weashop:buyItem') AddEventHandler('esx_weashop:buyItem', function(itemName, price, zone) - MySQL.Async.fetchAll('SELECT * FROM weashops', - {}, function(result) - local shopItems = {} - for i=1, #result, 1 do +LoadShopItems(function(shopItems) - if shopItems[result[i].name] == nil then - shopItems[result[i].name] = {} - end - - table.insert(shopItems[result[i].name], { - name = result[i].item, - price = result[i].price, - label = ESX.GetWeaponLabel(result[i].item) - }) - - end - - local _source = source + local _source = source local xPlayer = ESX.GetPlayerFromId(source) local account = xPlayer.getAccount('black_money') if price == shopItems[itemName].price then @@ -97,5 +82,8 @@ AddEventHandler('esx_weashop:buyItem', function(itemName, price, zone) end end - end) +end) + + + end) From 9cf5586d86b7e2d0305a5f9ae84ff6393532ba46 Mon Sep 17 00:00:00 2001 From: vecchiotom Date: Fri, 27 Apr 2018 21:10:51 +0200 Subject: [PATCH 4/4] I N D E N T --- server/main.lua | 102 ++++++++++++++++++++++++------------------------ 1 file changed, 51 insertions(+), 51 deletions(-) diff --git a/server/main.lua b/server/main.lua index 22d0fa21..36e8d7b1 100644 --- a/server/main.lua +++ b/server/main.lua @@ -5,85 +5,85 @@ TriggerEvent('esx:getSharedObject', function(obj) ESX = obj end) function LoadLicenses (source) TriggerEvent('esx_license:getLicenses', source, function (licenses) - TriggerClientEvent('esx_weashop:loadLicenses', source, licenses) + TriggerClientEvent('esx_weashop:loadLicenses', source, licenses) end) end if Config.EnableLicense == true then AddEventHandler('esx:playerLoaded', function (source) - LoadLicenses(source) + LoadLicenses(source) end) end function LoadShopItems(cb) - MySQL.Async.fetchAll('SELECT * FROM weashops', - {}, function(result) - local shopItems = {} - for i=1, #result, 1 do + MySQL.Async.fetchAll('SELECT * FROM weashops', + {}, function(result) + local shopItems = {} + for i=1, #result, 1 do - if shopItems[result[i].name] == nil then - shopItems[result[i].name] = {} - end + if shopItems[result[i].name] == nil then + shopItems[result[i].name] = {} + end - table.insert(shopItems[result[i].name], { - name = result[i].item, - price = result[i].price, - label = ESX.GetWeaponLabel(result[i].item) - }) - cb(shopItems) - end - end) + table.insert(shopItems[result[i].name], { + name = result[i].item, + price = result[i].price, + label = ESX.GetWeaponLabel(result[i].item) + }) + cb(shopItems) + end + end) end RegisterServerEvent('esx_weashop:buyLicense') AddEventHandler('esx_weashop:buyLicense', function () - local _source = source - local xPlayer = ESX.GetPlayerFromId(source) +local _source = source +local xPlayer = ESX.GetPlayerFromId(source) - if xPlayer.get('money') >= Config.LicensePrice then - xPlayer.removeMoney(Config.LicensePrice) +if xPlayer.get('money') >= Config.LicensePrice then + xPlayer.removeMoney(Config.LicensePrice) - TriggerEvent('esx_license:addLicense', _source, 'weapon', function () - LoadLicenses(_source) - end) - else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) - end + TriggerEvent('esx_license:addLicense', _source, 'weapon', function () + LoadLicenses(_source) + end) +else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) +end end) ESX.RegisterServerCallback('esx_weashop:requestDBItems', function(source, cb) - LoadShopItems(cb) +LoadShopItems(cb) end) RegisterServerEvent('esx_weashop:buyItem') AddEventHandler('esx_weashop:buyItem', function(itemName, price, zone) LoadShopItems(function(shopItems) - local _source = source - local xPlayer = ESX.GetPlayerFromId(source) - local account = xPlayer.getAccount('black_money') - if price == shopItems[itemName].price then - if zone=="BlackWeashop" then - if account.money >= price then - xPlayer.removeAccountMoney('black_money', price) - xPlayer.addWeapon(itemName, 42) - TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) - else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black')) - end - else - if xPlayer.get('money') >= price then - xPlayer.removeMoney(price) - xPlayer.addWeapon(itemName, 42) - TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) - else - TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) - end - end - end +local _source = source +local xPlayer = ESX.GetPlayerFromId(source) +local account = xPlayer.getAccount('black_money') +if price == shopItems[itemName].price then + if zone=="BlackWeashop" then + if account.money >= price then + xPlayer.removeAccountMoney('black_money', price) + xPlayer.addWeapon(itemName, 42) + TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough_black')) + end + else + if xPlayer.get('money') >= price then + xPlayer.removeMoney(price) + xPlayer.addWeapon(itemName, 42) + TriggerClientEvent('esx:showNotification', _source, _U('buy') .. ESX.GetWeaponLabel(itemName)) + else + TriggerClientEvent('esx:showNotification', _source, _U('not_enough')) + end + end +end end) - + end)