From 9878aeaeb2b59f7bef2eafbadf34b34b2e8e37f3 Mon Sep 17 00:00:00 2001 From: R0adRa93 <42512379+r0adra93@users.noreply.github.com> Date: Tue, 17 Jan 2023 10:01:36 -0500 Subject: [PATCH 1/4] Added PrepForSQL function (#914) performs a check to a string with expected patterns to be matched. --- server/functions.lua | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/server/functions.lua b/server/functions.lua index c472b68..7df5403 100644 --- a/server/functions.lua +++ b/server/functions.lua @@ -414,3 +414,15 @@ end function QBCore.Functions.Notify(source, text, type, length) TriggerClientEvent('QBCore:Notify', source, text, type, length) end + +--- SQL Pattern Matching +function QBCore.Functions.PrepForSQL(source,data,pattern) + local src = source + local player = QBCore.Functions.GetPlayer(src) + local result = string.match(data, pattern) + if not result or string.len(result) ~= string.len(data) then + TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Injection Attempted', 'red', string.format('%s Attempted a SQL Exploit!', player.PlayerData.license)) + return false + end + return true +end \ No newline at end of file From e6f5bf5ab686cbf53f73871421226480d7877814 Mon Sep 17 00:00:00 2001 From: Charlie Date: Wed, 18 Jan 2023 16:17:15 +0000 Subject: [PATCH 2/4] Remove vehicle keys depdency from core (#920) Co-authored-by: Zerio <54480523+Z3rio@users.noreply.github.com> --- client/events.lua | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/client/events.lua b/client/events.lua index b720f59..60fae33 100644 --- a/client/events.lua +++ b/client/events.lua @@ -160,6 +160,12 @@ end) RegisterNetEvent('QBCore:Client:VehicleInfo', function(info) local plate = QBCore.Functions.GetPlate(info.vehicle) + local hasKeys = true + + if GetResourceState('qb-vehiclekeys') == 'started' then + hasKeys = exports['qb-vehiclekeys']:HasKeys() + end + local data = { vehicle = info.vehicle, seat = info.seat, @@ -167,8 +173,9 @@ RegisterNetEvent('QBCore:Client:VehicleInfo', function(info) plate = plate, driver = GetPedInVehicleSeat(info.vehicle, -1), inseat = GetPedInVehicleSeat(info.vehicle, info.seat), - haskeys = exports['qb-vehiclekeys']:HasKeys(plate) + haskeys = hasKeys } + TriggerEvent('QBCore:Client:'..info.event..'Vehicle', data) end) From 01e8597f07c30bbfa7071146b1d9e6bead33bebf Mon Sep 17 00:00:00 2001 From: R0adRa93 <42512379+r0adra93@users.noreply.github.com> Date: Wed, 18 Jan 2023 12:53:38 -0500 Subject: [PATCH 3/4] [FIX] Security match sql (#925) * Added PrepForSQL function performs a check to a string with expected patterns to be matched. * Bug Fixes After talking with Stan I realized that it wasn't testing strings so I set it up to ensure data is a string. I also reworded the event log. --- server/functions.lua | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/functions.lua b/server/functions.lua index 7df5403..54218f0 100644 --- a/server/functions.lua +++ b/server/functions.lua @@ -417,11 +417,12 @@ end --- SQL Pattern Matching function QBCore.Functions.PrepForSQL(source,data,pattern) + data = tostring(data) local src = source local player = QBCore.Functions.GetPlayer(src) local result = string.match(data, pattern) if not result or string.len(result) ~= string.len(data) then - TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Injection Attempted', 'red', string.format('%s Attempted a SQL Exploit!', player.PlayerData.license)) + TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'SQL Exploit Attempted', 'red', string.format('%s attempted to exploit SQL!', player.PlayerData.license)) return false end return true From 7b68f72cecc70808bb18fd3f59457188f97e6872 Mon Sep 17 00:00:00 2001 From: Jack Date: Thu, 26 Jan 2023 01:58:28 +0000 Subject: [PATCH 4/4] Update vehicles.lua (#929) * Update vehicles.lua Remove the space after this, as when somebody tries to pull it out, it will break PDM due to the space in the model hash. * Bump version number Co-authored-by: zwkf --- fxmanifest.lua | 2 +- shared/vehicles.lua | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fxmanifest.lua b/fxmanifest.lua index d2e2ff5..55e59bf 100644 --- a/fxmanifest.lua +++ b/fxmanifest.lua @@ -2,7 +2,7 @@ fx_version 'cerulean' game 'gta5' description 'QB-Core' -version '1.2.1' +version '1.2.2' shared_scripts { 'config.lua', diff --git a/shared/vehicles.lua b/shared/vehicles.lua index c5cadd6..f9784bd 100644 --- a/shared/vehicles.lua +++ b/shared/vehicles.lua @@ -4991,7 +4991,7 @@ QBShared.Vehicles = { ['rhinehart'] = { ['name'] = 'Rhinehart', ['brand'] = 'Übermacht', - ['model'] = 'rhinehart ', + ['model'] = 'rhinehart', ['price'] = 105000, ['category'] = 'sedans', ['categoryLabel'] = 'Sedans',