From 7c3d1bc97341fd2a2c026ef3574399bbd9e9af2a Mon Sep 17 00:00:00 2001
From: Jack <28160910+JackGamesFTW@users.noreply.github.com>
Date: Sun, 28 Nov 2021 17:10:27 +0000
Subject: [PATCH] Fix security issue

---
 server/player.lua | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/server/player.lua b/server/player.lua
index a0cef91..00ff571 100644
--- a/server/player.lua
+++ b/server/player.lua
@@ -9,9 +9,9 @@ function QBCore.Player.Login(source, citizenid, newData)
     local src = source
     if src then
         if citizenid then
-            local result = exports.oxmysql:executeSync('SELECT * FROM players WHERE citizenid = ?', { citizenid })
-            local PlayerData = result[1]
-            if PlayerData then
+            local license = QBCore.Functions.GetIdentifier(src, 'license')
+            local PlayerData = exports.oxmysql:singleSync('SELECT * FROM players where citizenid = ?', { citizenid })
+            if PlayerData and license == PlayerData.license then
                 PlayerData.money = json.decode(PlayerData.money)
                 PlayerData.job = json.decode(PlayerData.job)
                 PlayerData.position = json.decode(PlayerData.position)
@@ -22,8 +22,11 @@ function QBCore.Player.Login(source, citizenid, newData)
                 else
                     PlayerData.gang = {}
                 end
+                QBCore.Player.CheckPlayerData(src, PlayerData)
+            else
+                DropPlayer(src, 'You Have Been Kicked For Exploitation')
+                TriggerEvent('qb-log:server:CreateLog', 'anticheat', 'Anti-Cheat', 'white', GetPlayerName(src) .. ' Has Been Dropped For Character Joining Exploit', false)
             end
-            QBCore.Player.CheckPlayerData(src, PlayerData)
         else
             QBCore.Player.CheckPlayerData(src, newData)
         end