Merge pull request #338 from EinS4ckZwiebeln/patch-01

Fix exploitable net events
qbcore-framework · Jan 13, 2024 · fe6584e · fe6584e
2 parents 39e2419 + 745f1db
commit fe6584e
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/server/main.lua b/server/main.lua
@@ -159,11 +159,17 @@ end)
 -- Events
 
 RegisterNetEvent('qb-garages:server:updateVehicleStats', function(plate, fuel, engine, body)
-    MySQL.update('UPDATE player_vehicles SET fuel = ?, engine = ?, body = ? WHERE plate = ?', { fuel, engine, body, plate })
+    local src = source
+    local Player = QBCore.Functions.GetPlayer(src)
+    if not Player then return end
+    MySQL.update('UPDATE player_vehicles SET fuel = ?, engine = ?, body = ? WHERE plate = ? AND citizenid = ?', { fuel, engine, body, plate, Player.PlayerData.citizenid })
 end)
 
 RegisterNetEvent('qb-garages:server:updateVehicleState', function(state, plate)
-    MySQL.update('UPDATE player_vehicles SET state = ?, depotprice = ? WHERE plate = ?', { state, 0, plate })
+    local src = source
+    local Player = QBCore.Functions.GetPlayer(src)
+    if not Player then return end
+    MySQL.update('UPDATE player_vehicles SET state = ?, depotprice = ? WHERE plate = ? AND citizenid = ?', { state, 0, plate, Player.PlayerData.citizenid })
 end)
 
 RegisterNetEvent('qb-garages:server:UpdateOutsideVehicle', function(plate, vehicleNetID)