From 96f9dab2a8a0f88fa5ecd0b0c9a61fbe152b306b Mon Sep 17 00:00:00 2001
From: ElPumpo <samo_kol@hotmail.com>
Date: Wed, 18 Sep 2019 18:39:21 +0200
Subject: [PATCH] Dont let model be changed, as it cant be changed in LS
 anyways and is used to cheat

Co-Authored-By: danishrp <danishrp@users.noreply.github.com>
---
 server/main.lua | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/server/main.lua b/server/main.lua
index 50e5145a..23432b8e 100644
--- a/server/main.lua
+++ b/server/main.lua
@@ -1,6 +1,7 @@
 ESX = nil
+local Vehicles
+
 TriggerEvent('esx:getSharedObject', function(obj) ESX = obj end)
-local Vehicles = nil
 
 RegisterServerEvent('esx_lscustom:buyMod')
 AddEventHandler('esx_lscustom:buyMod', function(price)
@@ -9,11 +10,12 @@ AddEventHandler('esx_lscustom:buyMod', function(price)
 	price = tonumber(price)
 
 	if Config.IsMechanicJobOnly then
+		local societyAccount
 
-		local societyAccount = nil
 		TriggerEvent('esx_addonaccount:getSharedAccount', 'society_mechanic', function(account)
 			societyAccount = account
 		end)
+
 		if price < societyAccount.money then
 			TriggerClientEvent('esx_lscustom:installMod', _source)
 			TriggerClientEvent('esx:showNotification', _source, _U('purchased'))
@@ -22,9 +24,7 @@ AddEventHandler('esx_lscustom:buyMod', function(price)
 			TriggerClientEvent('esx_lscustom:cancelInstallMod', _source)
 			TriggerClientEvent('esx:showNotification', _source, _U('not_enough_money'))
 		end
-
 	else
-
 		if price < xPlayer.getMoney() then
 			TriggerClientEvent('esx_lscustom:installMod', _source)
 			TriggerClientEvent('esx:showNotification', _source, _U('purchased'))
@@ -33,21 +33,33 @@ AddEventHandler('esx_lscustom:buyMod', function(price)
 			TriggerClientEvent('esx_lscustom:cancelInstallMod', _source)
 			TriggerClientEvent('esx:showNotification', _source, _U('not_enough_money'))
 		end
-
 	end
 end)
 
 RegisterServerEvent('esx_lscustom:refreshOwnedVehicle')
-AddEventHandler('esx_lscustom:refreshOwnedVehicle', function(myCar)
-	MySQL.Async.execute('UPDATE `owned_vehicles` SET `vehicle` = @vehicle WHERE `plate` = @plate',
-	{
-		['@plate']   = myCar.plate,
-		['@vehicle'] = json.encode(myCar)
-	})
+AddEventHandler('esx_lscustom:refreshOwnedVehicle', function(vehicleProps)
+	local xPlayer = ESX.GetPlayerFromId(source)
+
+	MySQL.Async.fetchAll('SELECT vehicle FROM owned_vehicles WHERE plate = @plate', {
+		['@plate'] = vehicleProps.plate
+	}, function(result)
+		if result[1] then
+			local vehicle = json.decode(result[1].vehicle)
+
+			if vehicleProps.model == vehicle.model then
+				MySQL.Async.execute('UPDATE owned_vehicles SET vehicle = @vehicle WHERE plate = @plate', {
+					['@plate'] = vehicleProps.plate,
+					['@vehicle'] = json.encode(vehicleProps)
+				})
+			else
+				print(('esx_lscustom: %s attempted to upgrade vehicle with mismatching vehicle model!'):format(xPlayer.identifier))
+			end
+		end
+	end)
 end)
 
 ESX.RegisterServerCallback('esx_lscustom:getVehiclesPrices', function(source, cb)
-	if Vehicles == nil then
+	if not Vehicles then
 		MySQL.Async.fetchAll('SELECT * FROM vehicles', {}, function(result)
 			local vehicles = {}