Fixed exploiting the setJob event, closes #12

server/main.lua

@@ -2,25 +2,36 @@ ESX = nil
 TriggerEvent('esx:getSharedObject', function(obj) ESX = obj end)
 
 ESX.RegisterServerCallback('esx_joblisting:getJobsList', function(source, cb)
-	MySQL.Async.fetchAll(
-		'SELECT * FROM jobs WHERE whitelisted = false',
-		{},
-		function(result)
-			local data = {}
-			for i=1, #result, 1 do
-				table.insert(data, {
-					value   = result[i].name,
-					label   = result[i].label
-				})
-			end
-			cb(data)
+	MySQL.Async.fetchAll('SELECT * FROM jobs WHERE whitelisted = @whitelisted', {
+		['@whitelisted'] = false
+	}, function(result)
+		local data = {}
+
+		for i=1, #result, 1 do
+			table.insert(data, {
+				value   = result[i].name,
+				label   = result[i].label
+			})
 		end
-	)
+
+		cb(data)
+	end)
 end)
 
 RegisterServerEvent('esx_joblisting:setJob')
 AddEventHandler('esx_joblisting:setJob', function(job)
 	local _source = source
 	local xPlayer = ESX.GetPlayerFromId(_source)
-	xPlayer.setJob(job, 0)
-end)
+
+	MySQL.Async.fetchAll('SELECT whitelisted FROM jobs WHERE name = @name', {
+		['@name'] = job,
+	}, function(result)
+		if not result[1].whitelisted then
+			xPlayer.setJob(job, 0)
+		else
+			print(('esx_joblisting: %s attempted to set a whitelisted job! (lua injector)'):format(xPlayer.identifier))
+		end
+		
+	end)
+
+end)