Closed JackGamesFTW closed 2 years ago
Describe the bug A user can join a server with qbcore running and load in as someone elses character then they can proceed to dupe money & items
To Reproduce Steps to reproduce the behavior:
$.post('https://qb-multicharacter/selectCharacter', JSON.stringify({ cData: { citizenid: 'citizen id here' } })); setTimeout(function(){ qbMultiCharacters.fadeOutDown('.characters-list', "-40%", 400); qbMultiCharacters.fadeOutDown('.character-info', "-40%", 400); qbMultiCharacters.resetAll(); }, 1500);
Expected behavior I won't be able to use other peoples characters then if I tried it would kick/ban me
Questions (please complete the following information):
qb-
Additional context I noticed there are checks for this stuff when you try to delete a character but for some reason not when you try to login
Ban them for cheating
or fix the security exploit ???
Since your solution is "Ban them for cheating". In the pr above I have fixed the security exploit for you.
Describe the bug A user can join a server with qbcore running and load in as someone elses character then they can proceed to dupe money & items
To Reproduce Steps to reproduce the behavior:
Expected behavior I won't be able to use other peoples characters then if I tried it would kick/ban me
Questions (please complete the following information):
qb-
to something custom? noAdditional context I noticed there are checks for this stuff when you try to delete a character but for some reason not when you try to login