Security improvement, resolves #36

client/main.lua

@@ -800,26 +800,35 @@ AddEventHandler('esx_vehicleshop:hasEnteredMarker', function (zone)
 
 		local playerPed = PlayerPedId()
 
-		if IsPedInAnyVehicle(playerPed, false) then
-			local vehicle     = GetVehiclePedIsIn(playerPed, false)
-			local vehicleData = nil
+		if IsPedSittingInAnyVehicle(playerPed) then
 
-			for i=1, #Vehicles, 1 do
-				if GetHashKey(Vehicles[i].model) == GetEntityModel(vehicle) then
-					vehicleData = Vehicles[i]
-					break
+			local vehicle     = GetVehiclePedIsIn(playerPed, false)
+			local vehicleData, model, resellPrice, plate
+
+			if GetPedInVehicleSeat(vehicle, -1) == playerPed then
+				for i=1, #Vehicles, 1 do
+					if GetHashKey(Vehicles[i].model) == GetEntityModel(vehicle) then
+						vehicleData = Vehicles[i]
+						break
+					end
 				end
+	
+				resellPrice = ESX.Math.Round(vehicleData.price / 100 * Config.ResellPercentage)
+				model = string.lower(GetDisplayNameFromVehicleModel(GetEntityModel(vehicle)))
+				plate = ESX.Math.Trim(GetVehicleNumberPlateText(vehicle))
+	
+				CurrentAction     = 'resell_vehicle'
+				CurrentActionMsg  = _U('sell_menu', vehicleData.name, ESX.Math.GroupDigits(resellPrice))
+	
+				CurrentActionData = {
+					vehicle = vehicle,
+					label = vehicleData.name,
+					price = resellPrice,
+					model = model,
+					plate = plate
+				}
 			end
 
-			local resellPrice = math.floor(vehicleData.price / 100 * Config.ResellPercentage)
-
-			CurrentAction     = 'resell_vehicle'
-			CurrentActionMsg  = _U('sell_menu', vehicleData.name, ESX.Math.GroupDigits(resellPrice))
-
-			CurrentActionData = {
-				vehicle = vehicle,
-				price   = resellPrice
-			}
 		end
 
 	elseif zone == 'BossActions' and Config.EnablePlayerManagement and ESX.PlayerData.job ~= nil and ESX.PlayerData.job.name == 'cardealer' and ESX.PlayerData.job.grade_name == 'boss' then
@@ -935,18 +944,20 @@ Citizen.CreateThread(function()
 						else
 							ESX.ShowNotification(_U('not_rental'))
 						end
-					end, GetVehicleNumberPlateText(CurrentActionData.vehicle))
+					end, ESX.Math.Trim(GetVehicleNumberPlateText(CurrentActionData.vehicle)))
 
 				elseif CurrentAction == 'resell_vehicle' then
 
-					ESX.TriggerServerCallback('esx_vehicleshop:resellVehicle', function(isOwnedVehicle)
-						if isOwnedVehicle then
+					ESX.TriggerServerCallback('esx_vehicleshop:resellVehicle', function(vehicleSold)
+
+						if vehicleSold then
 							ESX.Game.DeleteVehicle(CurrentActionData.vehicle)
-							ESX.ShowNotification(_U('vehicle_sold'))
+							ESX.ShowNotification(_U('vehicle_sold_for', CurrentActionData.label, ESX.Math.GroupDigits(CurrentActionData.price)))
 						else
 							ESX.ShowNotification(_U('not_yours'))
 						end
-					end, GetVehicleNumberPlateText(CurrentActionData.vehicle), CurrentActionData.price)
+
+					end, CurrentActionData.plate, CurrentActionData.model)
 
 				elseif CurrentAction == 'boss_actions_menu' then
 					OpenBossActionsMenu()

locales/br.lua

@@ -35,7 +35,6 @@ Locales['br'] = {
   ['vehicle_purchased']       = 'você comprou um veículo',
   ['vehicle_set_owned']       = 'Veículo ~y~%s~s~ foi atribuído a ~b~%s~s~',
   ['vehicle_set_rented']      = 'Veículo ~y~%s~s~ foi alugado para ~b~%s~s~',
-  ['vehicle_sold']            = 'Veículo ~g~vendido~s~',
   ['vehicle_sold_for']        = 'the ~b~%s~s~ has been ~y~sold~s~ for ~g~$%s~s~',
   ['vehicle_sold_to']         = 'Veículo ~y~%s~s~ vendido to ~b~%s~s~',
   ['deposit_stock']           = 'Colocar no estoque',

locales/en.lua

@@ -40,7 +40,6 @@ Locales['en'] = {
   ['vehicle_purchased']       = 'you bought a vehicle',
   ['vehicle_set_owned']       = 'vehicle ~y~%s~s~ has been assigned to ~b~%s~s~',
   ['vehicle_set_rented']      = 'vehicle ~y~%s~s~ has been rented to ~b~%s~s~',
-  ['vehicle_sold']            = 'the vehicle has been ~g~sold~s~',
   ['vehicle_sold_for']        = 'the ~b~%s~s~ has been ~y~sold~s~ for ~g~$%s~s~',
   ['vehicle_sold_to']         = 'the vehicle with plate ~y~%s~s~ has been sold to ~b~%s~s~',
   ['deposit_stock']           = 'deposit stock',

locales/fi.lua

@@ -40,7 +40,6 @@ Locales['fi'] = {
   ['vehicle_purchased']       = 'sinä ostit ajoneuvon',
   ['vehicle_set_owned']       = 'ajoneuvo ~y~%s~s~ on nyt määritetty henkilölle ~b~%s~s~',
   ['vehicle_set_rented']      = 'ajoneuvo ~y~%s~s~ on nyt vuokrattu henkilölle ~b~%s~s~',
-  ['vehicle_sold']            = 'ajoneuvo ~g~myyty~s~',
   ['vehicle_sold_for']        = 'the ~b~%s~s~ has been ~y~sold~s~ for ~g~$%s~s~',
   ['vehicle_sold_to']         = 'ajoneuvo ~y~%s~s~ myyty henkilölle ~b~%s~s~',
   ['deposit_stock']           = 'talleta firman varastoon',

locales/fr.lua

@@ -39,7 +39,6 @@ Locales['fr'] = {
   ['vehicle_purchased']               = 'Vous avez acheté un véhicule',
   ['vehicle_set_owned']               = 'Le véhicule ~y~%s~s~ a été attribué à ~b~%s~s~',
   ['vehicle_set_rented']              = 'Le véhicule ~y~%s~s~ a été loué à ~b~%s~s~',
-  ['vehicle_sold']                    = 'Véhicule ~g~vendu~s~',
   ['vehicle_sold_for']                = 'the ~b~%s~s~ has been ~y~sold~s~ for ~g~$%s~s~',
   ['vehicle_sold_to']                 = 'Véhicule ~y~%s~s~ vendu à ~b~%s~s~',
   ['deposit_stock']                   = 'déposer Stock',

locales/pl.lua

@@ -39,7 +39,6 @@ Locales['pl'] = {
   ['vehicle_purchased']       = 'kupujesz pojazd',
   ['vehicle_set_owned']       = 'pojazd ~y~%s~s~ został zarejestrowany na ~b~%s~s~',
   ['vehicle_set_rented']      = 'pojazd ~y~%s~s~ został wynajęty przez ~b~%s~s~',
-  ['vehicle_sold']            = 'pojazd został ~g~sprzedany~s~',
   ['vehicle_sold_to']         = 'pojazd ~y~%s~s~ został sprzedany do ~b~%s~s~',
   ['deposit_stock']           = 'deponuj przedmioty',
   ['take_stock']              = 'wyciągnij przedmioty',

locales/sv.lua

@@ -40,7 +40,6 @@ Locales['sv'] = {
   ['vehicle_purchased']       = 'du köpte fordonet',
   ['vehicle_set_owned']       = 'fordonet ~y~%s~s~ har tilldelats till ~b~%s~s~',
   ['vehicle_set_rented']      = 'fordonet ~y~%s~s~ har hyrts ut till ~b~%s~s~',
-  ['vehicle_sold']            = 'fordonet har ~g~sålts~s~',
   ['vehicle_sold_for']        = '~b~%s~s~ har ~y~sålts~s~ för ~g~%s SEK~s~',
   ['vehicle_sold_to']         = '~y~%s~s~ har sålts till ~b~%s~s~',
   ['deposit_stock']           = 'lägg in i förråd',

server/main.lua

@@ -311,44 +311,78 @@ ESX.RegisterServerCallback('esx_vehicleshop:giveBackVehicle', function (source,
 	end)
 end)
 
-ESX.RegisterServerCallback('esx_vehicleshop:resellVehicle', function (source, cb, plate, price) -- todo: remove price
+ESX.RegisterServerCallback('esx_vehicleshop:resellVehicle', function (source, cb, plate, model)
+	local resellPrice
+
+	-- calculate the resell price
+	for i=1, #Vehicles, 1 do
+		if Vehicles[i].model == model then
+			resellPrice = ESX.Math.Round(Vehicles[i].price / 100 * Config.ResellPercentage)
+			break
+		end
+	end
+
 	MySQL.Async.fetchAll('SELECT * FROM rented_vehicles WHERE plate = @plate', {
 		['@plate'] = plate
 	}, function (result)
-		if result[1] ~= nil then -- is it a rented vehicle?
+		if result[1] then -- is it a rented vehicle?
 			cb(false) -- it is, don't let the player sell it since he doesn't own it
 		else
 			local xPlayer = ESX.GetPlayerFromId(source)
 
-			MySQL.Async.fetchAll('SELECT * FROM owned_vehicles WHERE owner = @owner AND @plate = plate',
-			{
+			MySQL.Async.fetchAll('SELECT * FROM owned_vehicles WHERE owner = @owner AND @plate = plate', {
 				['@owner'] = xPlayer.identifier,
 				['@plate'] = plate
 			}, function (result)
 
-				-- does the owner match?
-				if result[1] ~= nil then
+				if result[1] then -- does the owner match?
 
-					-- todo: does model match?
-					xPlayer.addMoney(price)
-					RemoveOwnedVehicle(plate)
-					cb(true)
+					local vehicle = json.decode(result[1].vehicle)
+
+					if vehicle.model == GetHashKey(model) then
+						if vehicle.plate == plate then
+							xPlayer.addMoney(resellPrice)
+							RemoveOwnedVehicle(plate)
+							cb(true)
+						else
+							print(('esx_vehicleshop: %s attempted to sell an vehicle with plate mismatch!'):format(xPlayer.identifier))
+							cb(false)
+						end
+					else
+						print(('esx_vehicleshop: %s attempted to sell an vehicle with model mismatch!'):format(xPlayer.identifier))
+						cb(false)
+					end
 
 				else
 
 					if xPlayer.job.grade_name == 'boss' then
-						MySQL.Async.fetchAll('SELECT * FROM owned_vehicles WHERE owner = @owner AND @plate = plate',
-						{
+						MySQL.Async.fetchAll('SELECT * FROM owned_vehicles WHERE owner = @owner AND @plate = plate', {
 							['@owner'] = 'society:' .. xPlayer.job.name,
 							['@plate'] = plate
 						}, function (result)
-							if result[1] ~= nil then
-								xPlayer.addMoney(price)
-								RemoveOwnedVehicle(plate)
-								cb(true)
+
+							if result[1] then
+
+								local vehicle = json.decode(result[1].vehicle)
+
+								if vehicle.model == GetHashKey(model) then
+									if vehicle.plate == plate then
+										xPlayer.addMoney(resellPrice)
+										RemoveOwnedVehicle(plate)
+										cb(true)
+									else
+										print(('esx_vehicleshop: %s attempted to sell an vehicle with plate mismatch!'):format(xPlayer.identifier))
+										cb(false)
+									end
+								else
+									print(('esx_vehicleshop: %s attempted to sell an vehicle with model mismatch!'):format(xPlayer.identifier))
+									cb(false)
+								end
+
 							else
 								cb(false)
 							end
+
 						end)
 					else
 						cb(false)