From b944ad9659dd30800b719bb8a65d4a2a29cc05bf Mon Sep 17 00:00:00 2001
From: ElPumpo <samo_kol@hotmail.com>
Date: Tue, 20 Nov 2018 21:15:06 +0100
Subject: [PATCH] Secured events from non-cops

---
 client/main.lua | 29 ++++++++++++++++++++++-------
 server/main.lua | 30 +++++++++++++++++++++++++-----
 2 files changed, 47 insertions(+), 12 deletions(-)

diff --git a/client/main.lua b/client/main.lua
index c168ba6e..17df1788 100644
--- a/client/main.lua
+++ b/client/main.lua
@@ -956,7 +956,10 @@ function OpenUnpaidBillsMenu(player)
 
 	ESX.TriggerServerCallback('esx_billing:getTargetBills', function(bills)
 		for i=1, #bills, 1 do
-			table.insert(elements, {label = bills[i].label .. ' - <span style="color: red;">$' .. bills[i].amount .. '</span>', value = bills[i].id})
+			table.insert(elements, {
+				label = bills[i].label .. ' - <span style="color: red;">$' .. bills[i].amount .. '</span>',
+				value = bills[i].id
+			})
 		end
 
 		ESX.UI.Menu.Open('default', GetCurrentResourceName(), 'billing',
@@ -1006,7 +1009,10 @@ function OpenGetWeaponMenu()
 
 		for i=1, #weapons, 1 do
 			if weapons[i].count > 0 then
-				table.insert(elements, {label = 'x' .. weapons[i].count .. ' ' .. ESX.GetWeaponLabel(weapons[i].name), value = weapons[i].name})
+				table.insert(elements, {
+					label = 'x' .. weapons[i].count .. ' ' .. ESX.GetWeaponLabel(weapons[i].name),
+					value = weapons[i].name
+				})
 			end
 		end
 
@@ -1039,7 +1045,10 @@ function OpenPutWeaponMenu()
 		local weaponHash = GetHashKey(weaponList[i].name)
 
 		if HasPedGotWeapon(playerPed, weaponHash, false) and weaponList[i].name ~= 'WEAPON_UNARMED' then
-			table.insert(elements, {label = weaponList[i].label, value = weaponList[i].name})
+			table.insert(elements, {
+				label = weaponList[i].label,
+				value = weaponList[i].name
+			})
 		end
 	end
 
@@ -1079,7 +1088,7 @@ function OpenBuyWeaponsMenu(station)
 			end
 
 			table.insert(elements, {
-				label = 'x' .. count .. ' ' .. ESX.GetWeaponLabel(weapon.name) .. ' $' .. weapon.price,
+				label = 'x' .. count .. ' ' .. ESX.GetWeaponLabel(weapon.name) .. ' $' .. ESX.Math.GroupDigits(weapon.price),
 				value = weapon.name,
 				price = weapon.price
 			})
@@ -1114,11 +1123,13 @@ function OpenGetStocksMenu()
 
 	ESX.TriggerServerCallback('esx_policejob:getStockItems', function(items)
 
-
 		local elements = {}
 
 		for i=1, #items, 1 do
-			table.insert(elements, {label = 'x' .. items[i].count .. ' ' .. items[i].label, value = items[i].name})
+			table.insert(elements, {
+				label = 'x' .. items[i].count .. ' ' .. items[i].label,
+				value = items[i].name
+			})
 		end
 
 		ESX.UI.Menu.Open('default', GetCurrentResourceName(), 'stocks_menu',
@@ -1169,7 +1180,11 @@ function OpenPutStocksMenu()
 			local item = inventory.items[i]
 
 			if item.count > 0 then
-				table.insert(elements, {label = item.label .. ' x' .. item.count, type = 'item_standard', value = item.name})
+				table.insert(elements, {
+					label = item.label .. ' x' .. item.count,
+					type = 'item_standard',
+					value = item.name
+				})
 			end
 		end
 
diff --git a/server/main.lua b/server/main.lua
index dd5d9cfb..06470c76 100644
--- a/server/main.lua
+++ b/server/main.lua
@@ -12,7 +12,12 @@ TriggerEvent('esx_society:registerSociety', 'police', 'Police', 'society_police'
 RegisterServerEvent('esx_policejob:giveWeapon')
 AddEventHandler('esx_policejob:giveWeapon', function(weapon, ammo)
 	local xPlayer = ESX.GetPlayerFromId(source)
-	xPlayer.addWeapon(weapon, ammo)
+
+	if xPlayer.job.name == 'police' then
+		xPlayer.addWeapon(weapon, ammo)
+	else
+		print(('esx_policejob: %s attempted to give weapon!'):format(xPlayer.identifier))
+	end
 end)
 
 RegisterServerEvent('esx_policejob:confiscatePlayerItem')
@@ -21,6 +26,11 @@ AddEventHandler('esx_policejob:confiscatePlayerItem', function(target, itemType,
 	local sourceXPlayer = ESX.GetPlayerFromId(_source)
 	local targetXPlayer = ESX.GetPlayerFromId(target)
 
+	if sourceXPlayer.job.name ~= 'police' then
+		print(('esx_policejob: %s attempted to confiscate!'):format(xPlayer.identifier))
+		return
+	end
+
 	if itemType == 'item_standard' then
 		local targetItem = targetXPlayer.getInventoryItem(itemName)
 		local sourceItem = sourceXPlayer.getInventoryItem(itemName)
@@ -71,12 +81,24 @@ end)
 
 RegisterServerEvent('esx_policejob:drag')
 AddEventHandler('esx_policejob:drag', function(target)
-	TriggerClientEvent('esx_policejob:drag', target, source)
+	local xPlayer = ESX.GetPlayerFromId(source)
+
+	if xPlayer.job.name == 'police' then
+		TriggerClientEvent('esx_policejob:drag', target, source)
+	else
+		print(('esx_policejob: %s attempted to drag (not cop)!'):format(xPlayer.identifier))
+	end
 end)
 
 RegisterServerEvent('esx_policejob:putInVehicle')
 AddEventHandler('esx_policejob:putInVehicle', function(target)
-	TriggerClientEvent('esx_policejob:putInVehicle', target)
+	local xPlayer = ESX.GetPlayerFromId(source)
+
+	if xPlayer.job.name == 'police' then
+		TriggerClientEvent('esx_policejob:putInVehicle', target)
+	else
+		print(('esx_policejob: %s attempted to put in vehicle (not cop)!'):format(xPlayer.identifier))
+	end
 end)
 
 RegisterServerEvent('esx_policejob:OutVehicle')
@@ -278,7 +300,6 @@ end)
 ESX.RegisterServerCallback('esx_policejob:getArmoryWeapons', function(source, cb)
 
 	TriggerEvent('esx_datastore:getSharedDataStore', 'society_police', function(store)
-
 		local weapons = store.get('weapons')
 
 		if weapons == nil then
@@ -286,7 +307,6 @@ ESX.RegisterServerCallback('esx_policejob:getArmoryWeapons', function(source, cb
 		end
 
 		cb(weapons)
-
 	end)
 
 end)