fix: server-side input validation hardening across addons - #112
fix: server-side input validation hardening across addons#112ASTROWwwW wants to merge 17 commits into
Conversation
…y names (cherry picked from commit f7d40844c9b2d36cf31ee9490a18e15825a3aae3)
(cherry picked from commit 471bad9de7cdff5c4ba6d3c01d089135c82b171c)
…input (cherry picked from commit 600f2c03a11c684f33128ff1bd857ef674d627eb)
(cherry picked from commit cc0cac63e03621cdb0cbcef05fde6158ae28f9a4)
(cherry picked from commit 8abeea935a7c6a6019f8a3c6400184b5885b7afd)
(cherry picked from commit f59df8b55d14162349d230d6d924d57f605f5312)
(cherry picked from commit 74fb235cff29bf8e5ee7b188278ef697a9e5cb05)
(cherry picked from commit 17e654f98a5d252543386b14efb468d1011c6c8e)
(cherry picked from commit f39c3134ce9d486a6a9a810803373e1a56958d34)
(cherry picked from commit 8bf2112155fd37fb18754b46d3539b5116b1bf20)
(cherry picked from commit 7672fd7a7d421f1044a7bee92e366c1bdac32cd3)
…lers (cherry picked from commit 20a8a9436459eec064250da32ecf094b9d3f2dd5)
(cherry picked from commit 1785fef8367e8c4d4654a6e102a2da6c83c837d6)
(cherry picked from commit 69309a19a222edd6ea95d3e3486fa1d699faf18e)
(cherry picked from commit cd4fe95f8d60bb935fda263f82c94d575d768f14)
(cherry picked from commit 94f2e493c6fe2840b46bea23e6851d5daaf4ef78)
(cherry picked from commit d822274624b32587a5dd2600d9dcdf0674df332d)
|
esx_property:leave: You are not checking whether the player is inside the property, within the correct coordinates, or in the correct routing bucket. Authorization bypass in esx_society: When setJob targets an offline employee, the action is executed directly without verifying that the caller has the required permissions to modify that employee’s job or grade. esx_vehicleshop: Vehicle data manipulation in player-to-player sales: The stock is validated using the client-provided model, but the full vehicleProps object, along with the client-provided label and price, is stored afterward. There are no apparent server-side checks to ensure that vehicleProps.model == model or that the label and price match the vehicle’s authoritative data, allowing a client to manipulate the vehicle information and sale price. esx_shops: Remote shop purchase vulnerability: Shops validate the zone, item, and price, but there is no apparent server-side distance check. A player could purchase items remotely by submitting a valid shop zone without being physically near it. |
Server now validates/recomputes client-supplied values (amounts, quantities, ownership, permissions) instead of trusting them, plus nil-guards. No change for legit players.
Modules: addoninventory, banking, basicneeds, billing, boat, clotheshop, datastore, license, property, rpchat, service, shops, society, status, vehicleshop.