qbcore-framework / qb-inventory

Slot Based Inventory System Used With QB-Core :school_satchel:
GNU General Public License v3.0
53 stars 380 forks source link

fix: prevent item dupe exploit on item swap #573

Closed Qwerty1Verified closed 2 months ago

Qwerty1Verified commented 2 months ago

Description

This PR fixes a duplication exploit and stops the front-end from sending a custom item transfer amount when two items that aren't the same are being swapped. This amount is unneeded for this action since the two items can't be stacked by any amount and need to completely swap if they're two different items.

This PR also updates the server-side of this request by not using the amounts provided by the front-end for swapping, and instead using the back-end .amount values known to the inventory. This is because for completely swapping two items, the full amounts for both items should be swapped, and no values from the client should be trusted unless performing an item name check on that slot after removal.

This could also be fixed across the board with other changes and validation to some exports.

This PR addresses the duplication exploit issues: #569, #563

Checklist

Qwerty1Verified commented 2 months ago

New commit addresses another bug with the UI on give item displaying the item being removed despite no one being around. This is issue: https://github.com/qbcore-framework/qb-inventory/issues/567

Qwerty1Verified commented 2 months ago

Also addresses the duplication and UI issue https://github.com/qbcore-framework/qb-inventory/issues/563