From ae64a9ed020e6b2b43183be6e81f06a3bca90b25 Mon Sep 17 00:00:00 2001
From: uShifty <51722240+uShifty@users.noreply.github.com>
Date: Sat, 1 Jan 2022 22:23:12 -0800
Subject: [PATCH] Fix(RemoveItem): Exploit Remove Item

This issues fixes the possible exploit when removing an item when sending the item slot parameter before you were able to send any amount of an item and it would return as if the remove item worked just fine returning true
---
 server/player.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/player.lua b/server/player.lua
index 00ff571..4d2a4ca 100644
--- a/server/player.lua
+++ b/server/player.lua
@@ -366,7 +366,7 @@ function QBCore.Player.CreatePlayer(PlayerData)
                 self.Functions.UpdatePlayerData()
                 TriggerEvent('qb-log:server:CreateLog', 'playerinventory', 'RemoveItem', 'red', '**' .. GetPlayerName(self.PlayerData.source) .. ' (citizenid: ' .. self.PlayerData.citizenid .. ' | id: ' .. self.PlayerData.source .. ')** lost item: [slot:' .. slot .. '], itemname: ' .. self.PlayerData.items[slot].name .. ', removed amount: ' .. amount .. ', new total amount: ' .. self.PlayerData.items[slot].amount)
                 return true
-            else
+            elseif self.PlayerData.items[slot].amount == amount then
                 self.PlayerData.items[slot] = nil
                 self.Functions.UpdatePlayerData()
                 TriggerEvent('qb-log:server:CreateLog', 'playerinventory', 'RemoveItem', 'red', '**' .. GetPlayerName(self.PlayerData.source) .. ' (citizenid: ' .. self.PlayerData.citizenid .. ' | id: ' .. self.PlayerData.source .. ')** lost item: [slot:' .. slot .. '], itemname: ' .. item .. ', removed amount: ' .. amount .. ', item removed')