From 5410bf75e89e69087421b1c279ffbf80e2f3b04e Mon Sep 17 00:00:00 2001 From: ElPumpo Date: Wed, 31 Oct 2018 14:33:05 +0100 Subject: [PATCH] Secutity improvements, lua executor safe --- client/job.lua | 14 ++++++---- locales/br.lua | 2 +- locales/en.lua | 10 ++++---- locales/es.lua | 6 ++--- locales/fi.lua | 2 +- locales/fr.lua | 2 +- locales/pl.lua | 2 +- locales/sv.lua | 4 +-- server/main.lua | 68 ++++++++++++++++++++++++++++++++----------------- 9 files changed, 68 insertions(+), 42 deletions(-) diff --git a/client/job.lua b/client/job.lua index 80943ecc..529ec5fb 100644 --- a/client/job.lua +++ b/client/job.lua @@ -420,7 +420,10 @@ function OpenVehicleSpawnerMenu() ESX.TriggerServerCallback('esx_society:getVehiclesInGarage', function(vehicles) for i=1, #vehicles, 1 do - table.insert(elements, {label = GetDisplayNameFromVehicleModel(vehicles[i].model) .. ' [' .. vehicles[i].plate .. ']', value = vehicles[i]}) + table.insert(elements, { + label = GetDisplayNameFromVehicleModel(vehicles[i].model) .. ' [' .. vehicles[i].plate .. ']', + value = vehicles[i] + }) end ESX.UI.Menu.Open('default', GetCurrentResourceName(), 'vehicle_spawner', @@ -432,7 +435,7 @@ function OpenVehicleSpawnerMenu() menu.close() local vehicleProps = data.current.value - ESX.Game.SpawnVehicle(vehicleProps.model, Config.Zones.VehicleSpawnPoint.Pos, 270.0, function(vehicle) + ESX.Game.SpawnVehicle(vehicleProps.model, Config.Zones.VehicleSpawnPoint.Pos, 230.0, function(vehicle) ESX.Game.SetVehicleProperties(vehicle, vehicleProps) local playerPed = PlayerPedId() TaskWarpPedIntoVehicle(playerPed, vehicle, -1) @@ -478,13 +481,14 @@ function OpenPharmacyMenu() title = _U('pharmacy_menu_title'), align = 'top-left', elements = { - {label = _U('pharmacy_take') .. ' ' .. _('medikit'), value = 'medikit'}, - {label = _U('pharmacy_take') .. ' ' .. _('bandage'), value = 'bandage'} + {label = _U('pharmacy_take', _U('medikit')), value = 'medikit'}, + {label = _U('pharmacy_take', _U('bandage')), value = 'bandage'} } }, function(data, menu) TriggerServerEvent('esx_ambulancejob:giveItem', data.current.value) end, function(data, menu) menu.close() + CurrentAction = 'pharmacy' CurrentActionMsg = _U('open_pharmacy') CurrentActionData = {} @@ -526,7 +530,7 @@ AddEventHandler('esx_ambulancejob:heal', function(healType) if healType == 'small' then local health = GetEntityHealth(playerPed) - local newHealth = math.min(maxHealth , math.floor(health + maxHealth/8)) + local newHealth = math.min(maxHealth, math.floor(health + maxHealth / 8)) SetEntityHealth(playerPed, newHealth) elseif healType == 'big' then SetEntityHealth(playerPed, maxHealth) diff --git a/locales/br.lua b/locales/br.lua index aada55b4..1e934fcb 100644 --- a/locales/br.lua +++ b/locales/br.lua @@ -30,7 +30,7 @@ Locales['br'] = { ['fast_travel'] = 'Aperte ~INPUT_CONTEXT~ para mover-se rapidamente.', ['open_pharmacy'] = 'Aperte ~INPUT_CONTEXT~ para abrir a farmácia.', ['pharmacy_menu_title'] = 'Farmácia', - ['pharmacy_take'] = 'Tomar', + ['pharmacy_take'] = 'tomar ~y~%s~s~', ['medikit'] = 'Seringa', ['bandage'] = 'Vendagem', ['max_item'] = 'você já carrega o suficiente sobre você.', diff --git a/locales/en.lua b/locales/en.lua index 8bef3b95..17c85a22 100644 --- a/locales/en.lua +++ b/locales/en.lua @@ -27,13 +27,13 @@ Locales['en'] = { ['open_menu'] = 'press ~INPUT_CONTEXT~ to open the menu', ['deposit_amount'] = 'deposit Amount', ['money_withdraw'] = 'amount withdrawn', - ['fast_travel'] = 'Press on ~INPUT_CONTEXT~ to fast travel.', - ['open_pharmacy'] = 'Press on ~INPUT_CONTEXT~ to open the pharmacy.', - ['pharmacy_menu_title'] = 'Pharmacy', - ['pharmacy_take'] = 'Take', + ['fast_travel'] = 'press ~INPUT_CONTEXT~ to fast travel.', + ['open_pharmacy'] = 'press ~INPUT_CONTEXT~ to open the pharmacy.', + ['pharmacy_menu_title'] = 'pharmacy', + ['pharmacy_take'] = 'take ~y~%s~s~', ['medikit'] = 'medikit', ['bandage'] = 'bandage', - ['max_item'] = 'You are already carrying enough on yourself.', + ['max_item'] = 'You are already carrying enough.', -- F6 Menu ['ems_menu'] = 'EMS Menu', ['ems_menu_title'] = 'ambulance - EMS Menu', diff --git a/locales/es.lua b/locales/es.lua index 00f3a7ef..2445a06e 100644 --- a/locales/es.lua +++ b/locales/es.lua @@ -27,10 +27,10 @@ Locales['es'] = { ['open_menu'] = 'Presione ~INPUT_CONTEXT~ para abrir el menú', ['deposit_amount'] = 'cantidad de fianza depositada', ['money_withdraw'] = 'cantidad de fianza retirada', - ['fast_travel'] = 'Press on ~INPUT_CONTEXT~ to fast travel.', - ['open_pharmacy'] = 'Press on ~INPUT_CONTEXT~ to open the pharmacy.', + ['fast_travel'] = 'Press ~INPUT_CONTEXT~ to fast travel.', + ['open_pharmacy'] = 'Press ~INPUT_CONTEXT~ to open the pharmacy.', ['pharmacy_menu_title'] = 'Pharmacy', - ['pharmacy_take'] = 'Take', + ['pharmacy_take'] = 'take ~y~%s~s~', ['medikit'] = 'medikit', ['bandage'] = 'bandage', ['max_item'] = 'You are already carrying enough on yourself.', diff --git a/locales/fi.lua b/locales/fi.lua index d51ba970..59574c21 100644 --- a/locales/fi.lua +++ b/locales/fi.lua @@ -30,7 +30,7 @@ Locales['fi'] = { ['fast_travel'] = 'paina ~INPUT_CONTEXT~ liikkuaksesi nopeasti kerrosten välillä', ['open_pharmacy'] = 'paina ~INPUT_CONTEXT~ avataksesi lääkekaappi', ['pharmacy_menu_title'] = 'lääkekaappi', - ['pharmacy_take'] = 'ota', + ['pharmacy_take'] = 'ota ~y~%s~s~', ['medikit'] = 'ensiapupakkauksia', ['bandage'] = 'sideharsoja', ['max_item'] = 'sinulla on jo tarpeeksi mukana', diff --git a/locales/fr.lua b/locales/fr.lua index 3664d892..1fa2cca3 100644 --- a/locales/fr.lua +++ b/locales/fr.lua @@ -30,7 +30,7 @@ Locales['fr'] = { ['fast_travel'] = 'appuyez sur ~INPUT_CONTEXT~ pour vous déplacer rapidement.', ['open_pharmacy'] = 'appuyez sur ~INPUT_CONTEXT~ pour ouvrir la pharmacie.', ['pharmacy_menu_title'] = 'Pharmacie', - ['pharmacy_take'] = 'Prendre', + ['pharmacy_take'] = 'prendre ~y~%s~s~', ['medikit'] = 'kit de soin', ['bandage'] = 'bandage', ['max_item'] = 'vous en portez déjà assez sur vous.', diff --git a/locales/pl.lua b/locales/pl.lua index 1d2a0931..31b5486a 100644 --- a/locales/pl.lua +++ b/locales/pl.lua @@ -30,7 +30,7 @@ Locales['pl'] = { ['fast_travel'] = 'naciśnij na ~INPUT_CONTEXT~ do szybkiej podróży.', ['open_pharmacy'] = 'naciśnij na ~INPUT_CONTEXT~ aby otworzyć aptekę', ['pharmacy_menu_title'] = 'apteka', - ['pharmacy_take'] = 'weź', + ['pharmacy_take'] = 'weź ~y~%s~s~', ['medikit'] = 'apteczka', ['bandage'] = 'bandaż', ['max_item'] = 'już masz na sobie dość.', diff --git a/locales/sv.lua b/locales/sv.lua index 72fb6b05..ae3f4a04 100644 --- a/locales/sv.lua +++ b/locales/sv.lua @@ -30,7 +30,7 @@ Locales['sv'] = { ['fast_travel'] = 'tryck på ~INPUT_CONTEXT~ för att snabbresa.', ['open_pharmacy'] = 'tryck på ~INPUT_CONTEXT~ för att öppna apoteket.', ['pharmacy_menu_title'] = 'apotek', - ['pharmacy_take'] = 'ta', + ['pharmacy_take'] = 'ta ~y~%s~s~', ['medikit'] = 'medicinkit', ['bandage'] = 'bandage', ['max_item'] = 'du har redan tillräckligt mycket på dig.', @@ -47,7 +47,7 @@ Locales['sv'] = { ['respawn_available_in'] = 'respawn tillgänglig om ~b~%s:%s~s~', ['respawn_bleedout_in'] = 'du kommer att blöda ut om ~b~%s:%s~s~\n', ['respawn_bleedout_prompt'] = 'håll [~b~E~s~] för att respawna', - ['respawn_bleedout_fine'] = 'håll [~b~E~s~] för att respawna, kostar ~g~$%s~s~', + ['respawn_bleedout_fine'] = 'håll [~b~E~s~] för att respawna, kostar ~g~%s SEK~s~', ['respawn_bleedout_fine_msg'] = 'du betalade ~r~%s SEK~s~ för att respawna.', ['distress_send'] = 'tryck ~b~[G]~s~ för att skicka nödsignal', ['distress_sent'] = 'nödsignal har skickats till samtliga enheter!', diff --git a/server/main.lua b/server/main.lua index 76604682..4eb51635 100644 --- a/server/main.lua +++ b/server/main.lua @@ -4,22 +4,36 @@ TriggerEvent('esx:getSharedObject', function(obj) ESX = obj end) RegisterServerEvent('esx_ambulancejob:revive') AddEventHandler('esx_ambulancejob:revive', function(target) - local _source = source - local xPlayer = ESX.GetPlayerFromId(_source) + local xPlayer = ESX.GetPlayerFromId(source) - xPlayer.addMoney(Config.ReviveReward) - TriggerClientEvent('esx_ambulancejob:revive', target) + if xPlayer.job.name == 'ambulance' then + xPlayer.addMoney(Config.ReviveReward) + TriggerClientEvent('esx_ambulancejob:revive', target) + else + print(('esx_ambulancejob: %s attempted to revive!'):format(xPlayer.identifier)) + end end) RegisterServerEvent('esx_ambulancejob:heal') AddEventHandler('esx_ambulancejob:heal', function(target, type) - TriggerClientEvent('esx_ambulancejob:heal', target, type) + local xPlayer = ESX.GetPlayerFromId(source) + + if xPlayer.job.name == 'ambulance' then + TriggerClientEvent('esx_ambulancejob:heal', target, type) + else + print(('esx_ambulancejob: %s attempted to heal!'):format(xPlayer.identifier)) + end end) RegisterServerEvent('esx_ambulancejob:putInVehicle') AddEventHandler('esx_ambulancejob:putInVehicle', function(target) + local xPlayer = ESX.GetPlayerFromId(source) - TriggerClientEvent('esx_ambulancejob:putInVehicle', target) + if xPlayer.job.name == 'ambulance' then + TriggerClientEvent('esx_ambulancejob:putInVehicle', target) + else + print(('esx_ambulancejob: %s attempted to put in vehicle!'):format(xPlayer.identifier)) + end end) TriggerEvent('esx_phone:registerNumber', 'ambulance', _U('alert_ambulance'), true, true) @@ -112,26 +126,34 @@ end) RegisterServerEvent('esx_ambulancejob:giveItem') AddEventHandler('esx_ambulancejob:giveItem', function(itemName) - local _source = source - local xPlayer = ESX.GetPlayerFromId(_source) - local item = xPlayer.getInventoryItem(itemName) - local count = 1 + local xPlayer = ESX.GetPlayerFromId(source) - if item.limit ~= -1 then - count = item.limit - item.count + if xPlayer.job.name ~= 'ambulance' then + print(('esx_ambulancejob: %s attempted to spawn in an item!'):format(xPlayer.identifier)) + return + elseif itemName ~= 'medikit' or itemName ~= 'bandage' then + print(('esx_ambulancejob: %s attempted to spawn in an item!'):format(xPlayer.identifier)) + return end - if item.count < item.limit then + local xItem = xPlayer.getInventoryItem(itemName) + + local count = 1 + if xItem.limit ~= -1 then + count = xItem.limit - xItem.count + end + + if xItem.count < xItem.limit then xPlayer.addInventoryItem(itemName, count) else - TriggerClientEvent('esx:showNotification', _source, _U('max_item')) + TriggerClientEvent('esx:showNotification', source, _U('max_item')) end end) TriggerEvent('es:addGroupCommand', 'revive', 'admin', function(source, args, user) if args[1] ~= nil then if GetPlayerName(tonumber(args[1])) ~= nil then - print('esx_ambulancejob: ' .. GetPlayerName(source) .. ' is reviving a player!') + print(('esx_ambulancejob: %s used admin revive'):format(GetPlayerIdentifiers(source)[1])) TriggerClientEvent('esx_ambulancejob:revive', tonumber(args[1])) end else @@ -139,7 +161,7 @@ TriggerEvent('es:addGroupCommand', 'revive', 'admin', function(source, args, use end end, function(source, args, user) TriggerClientEvent('chat:addMessage', source, { args = { '^1SYSTEM', 'Insufficient Permissions.' } }) -end, { help = _U('revive_help'), params = { { name = 'id' } } }) +end, { help = _U('revive_help'), params = {{ name = 'id' }} }) ESX.RegisterUsableItem('medikit', function(source) local _source = source @@ -161,12 +183,11 @@ RegisterServerEvent('esx_ambulancejob:firstSpawn') AddEventHandler('esx_ambulancejob:firstSpawn', function() local _source = source local identifier = GetPlayerIdentifiers(_source)[1] - MySQL.Async.fetchScalar('SELECT isDead FROM users WHERE identifier=@identifier', - { + MySQL.Async.fetchScalar('SELECT isDead FROM users WHERE identifier = @identifier', { ['@identifier'] = identifier }, function(isDead) if isDead == 1 then - print('esx_ambulancejob: ' .. GetPlayerName(_source) .. ' (' .. identifier .. ') attempted combat logging!') + print(('esx_ambulancejob: %s attempted combat logging!'):format(identifier)) TriggerClientEvent('esx_ambulancejob:requestDeath', _source) end end) @@ -174,10 +195,11 @@ end) RegisterServerEvent('esx_ambulancejob:setDeathStatus') AddEventHandler('esx_ambulancejob:setDeathStatus', function(isDead) - local _source = source - MySQL.Sync.execute("UPDATE users SET isDead=@isDead WHERE identifier=@identifier", + local identifier = GetPlayerIdentifiers(source)[1] + + MySQL.Sync.execute("UPDATE users SET isDead=@isDead WHERE identifier = @identifier", { - ['@identifier'] = GetPlayerIdentifiers(_source)[1], - ['@isDead'] = isDead + ['@identifier'] = identifier, + ['@isDead'] = isDead }) end)