From ee768270dd11a8046913769124fcceda1023b7f9 Mon Sep 17 00:00:00 2001 From: ElPumpo Date: Sun, 4 Nov 2018 12:33:22 +0100 Subject: [PATCH] Make sure only admin can write to disk #13 --- server/main.lua | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/server/main.lua b/server/main.lua index 5a9ff59c..7141a161 100644 --- a/server/main.lua +++ b/server/main.lua @@ -15,17 +15,27 @@ end) RegisterServerEvent('esx_skin:responseSaveSkin') AddEventHandler('esx_skin:responseSaveSkin', function(skin) - local file = io.open('resources/[esx]/esx_skin/skins.txt', "a") - file:write(json.encode(skin) .. "\n\n") - file:flush() - file:close() + TriggerEvent('es:getPlayerFromId', source, function(user) + TriggerEvent('es:canGroupTarget', user.getGroup(), "admin", function(available) + if available then + local file = io.open('resources/[esx]/esx_skin/skins.txt', "a") + + file:write(json.encode(skin) .. "\n\n") + file:flush() + file:close() + else + print(('esx_skin: %s attempted saving skin to file'):format(user.getIdentifier())) + end + end) + end) + end) ESX.RegisterServerCallback('esx_skin:getPlayerSkin', function(source, cb) local xPlayer = ESX.GetPlayerFromId(source) - MySQL.Async.fetchAll('SELECT * FROM users WHERE identifier = @identifier', { + MySQL.Async.fetchAll('SELECT skin FROM users WHERE identifier = @identifier', { ['@identifier'] = xPlayer.identifier }, function(users) local user = users[1]