[BUG] Shop Exploit

[draobrehtom]

Summary

Client-side manipulation of shop inventory items and prices.

Reproduction

RegisterCommand('exploit', function()
    local shop = 'test'
    local ShopItems = {
        label = 'hack',
        items = {
            {name="water_bottle",amount=999999,price=-10000,slot=1},
            {name="weapon_vintagepistol",amount=999999,price=0,slot=2},
            {name="casinochips",amount=999999,price=0,slot=3},
        },
    }
    TriggerServerEvent("inventory:server:OpenInventory", "shop", "Itemshop_" .. shop, ShopItems)
end)

Expected behavior

I expected the shop inventory and item prices to be securely controlled and managed on the server-side to prevent any client-side manipulation or unauthorized access.

Actual behavior

Currently, the shop inventory and item prices are managed on the client-side, which allows for potential manipulation and unauthorized access by users.

Additional context

Last Updated

Today

Custom Resources

No

Resource Rename

No

[github-actions[bot]]

This issue has had 60 days of inactivity & will close within 7 days

[draobrehtom]

Possible hot-fix solution is https://github.com/qbcore-framework/qb-inventory/compare/main...draobrehtom:qb-inventory:main

[github-actions[bot]]

This issue has had 60 days of inactivity & will close within 7 days

[draobrehtom]

https://github.com/qbcore-framework/qb-inventory/blob/00a092e0999e901518759ee3afde121ff9c7f8cc/server/main.lua#L267