qbcore-framework / qb-core

FiveM RP Framework Core :muscle:
GNU General Public License v3.0
586 stars 962 forks source link

[BUG] Users can use other peoples characters #346

Closed JackGamesFTW closed 2 years ago

JackGamesFTW commented 2 years ago

Describe the bug A user can join a server with qbcore running and load in as someone elses character then they can proceed to dupe money & items

To Reproduce Steps to reproduce the behavior:

  1. Join a server
  2. Open the chrome inspector and run the following javascript with the citizen id of the character you want to use
    $.post('https://qb-multicharacter/selectCharacter', JSON.stringify({
    cData: { citizenid: 'citizen id here' }
    }));
    setTimeout(function(){
    qbMultiCharacters.fadeOutDown('.characters-list', "-40%", 400);
    qbMultiCharacters.fadeOutDown('.character-info', "-40%", 400);
    qbMultiCharacters.resetAll();
    }, 1500);

Expected behavior I won't be able to use other peoples characters then if I tried it would kick/ban me

Questions (please complete the following information):

Additional context I noticed there are checks for this stuff when you try to delete a character but for some reason not when you try to login

GhzGarage commented 2 years ago

Ban them for cheating

mason-rogers commented 2 years ago

Ban them for cheating

or fix the security exploit ???

JackGamesFTW commented 2 years ago

Since your solution is "Ban them for cheating". In the pr above I have fixed the security exploit for you.