Moving to server side checks for inventory

[r0adra93]

Security Fix for qb-policejob that coincides with inventory security fix located at: qbcore-framework/qb-inventory#380

Questions (please complete the following information):

• Have you personally loaded this code into an updated qbcore project and checked all it's functionality? [yes/no] (Be honest)
• Does your code fit the style guidelines? [yes/no]
• Does your PR fit the contribution guidelines? [yes/no]

[Irishstevie]

I run this with qb-policejob: #380

Tested storage Pull out cars open all the menus

Works good

[SKITTLE6969]

Im getting this error after updating this along with the inventory :|

[r0adra93]

Im getting this error after updating this along with the inventory :|

Is this off a vanilla install of the core or do you have a bunch of addons?

[r0adra93]

Im getting this error after updating this along with the inventory :|

I am unable to reproduce on a vanilla install.
I had to update the inventory from github as the vanilla install doesn't include the latest merge.

However, this works as intended and expected with no errors.

[Z3rio]

Anyone can give themselves all police items just by triggering the police:server:addVehItems event.
Here are the possible fixes for this:

• Use a callback instead of an event (easiest but not preferred fix)
• Create a table of all vehicle plates spawned through qb-policejob (someway) and check if the vehicle is in there, or simply check if the plate has the correct syntax
• Check if the vehicle model is correct (hardest but kinda best one)

[r0adra93]

Anyone can give themselves all police items just by triggering the police:server:addVehItems event. Here are the possible fixes for this:

• Use a callback instead of an event (easiest but not preferred fix)
• Create a table of all vehicle plates spawned through qb-policejob (someway) and check if the vehicle is in there, or simply check if the plate has the correct syntax
• Check if the vehicle model is correct (hardest but kinda best one)

Qb-jobs resolves all these issues.
I'll reference it to make the changes here.

[Z3rio]

Anyone can give themselves all police items just by triggering the police:server:addVehItems event. Here are the possible fixes for this:

• Use a callback instead of an event (easiest but not preferred fix)
• Create a table of all vehicle plates spawned through qb-policejob (someway) and check if the vehicle is in there, or simply check if the plate has the correct syntax
• Check if the vehicle model is correct (hardest but kinda best one)

Qb-jobs resolves all these issues. I'll reference it to make the changes here.

Okay, but you do have to understand that I cant commit a PR with such security issue.

[r0adra93]

Anyone can give themselves all police items just by triggering the police:server:addVehItems event. Here are the possible fixes for this:

• Use a callback instead of an event (easiest but not preferred fix)
• Create a table of all vehicle plates spawned through qb-policejob (someway) and check if the vehicle is in there, or simply check if the plate has the correct syntax
• Check if the vehicle model is correct (hardest but kinda best one)

Qb-jobs resolves all these issues. I'll reference it to make the changes here.

Okay, but you do have to understand that I cant commit a PR with such security issue.

That's fine i'll pull the trackVeh table, vehCount table and call backs from qb-jobs.

[r0adra93]

Anyone can give themselves all police items just by triggering the police:server:addVehItems event. Here are the possible fixes for this:

• Use a callback instead of an event (easiest but not preferred fix)
• Create a table of all vehicle plates spawned through qb-policejob (someway) and check if the vehicle is in there, or simply check if the plate has the correct syntax
• Check if the vehicle model is correct (hardest but kinda best one)

Qb-jobs resolves all these issues. I'll reference it to make the changes here.

Okay, but you do have to understand that I cant commit a PR with such security issue.

I DID ALL OF THIS AND STILL NOT MERGED IN!

Road confirmed this is now resolved