Merge pull request #573 from Qwerty1Verified/main

fix: prevent item dupe exploit on item swap
qbcore-framework · Sep 7, 2024 · f31e85a · f31e85a
2 parents e8c6805 + fc9f32b
commit f31e85a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 5 deletions.
diff --git a/html/app.js b/html/app.js
@@ -482,7 +482,7 @@ const InventoryContainer = Vue.createApp({
                         targetInventory[targetSlotNumber] = sourceItem;
                         sourceInventory[this.currentlyDraggingSlot].slot = this.currentlyDraggingSlot;
                         targetInventory[targetSlotNumber].slot = targetSlotNumber;
-                        this.postInventoryData(this.dragStartInventoryType, targetInventoryType, this.currentlyDraggingSlot, targetSlotNumber, amountToTransfer, targetItem.amount);
+                        this.postInventoryData(this.dragStartInventoryType, targetInventoryType, this.currentlyDraggingSlot, targetSlotNumber, sourceItem.amount, targetItem.amount);
                     }
                 } else {
                     sourceItem.amount -= amountToTransfer;
@@ -589,6 +589,7 @@ const InventoryContainer = Vue.createApp({
                         });
 
                         if (response.data) {
+                            delete this.playerInventory[playerItemKey];
                             this.otherInventory[1] = newItem;
                             this.otherInventoryName = response.data;
                             this.otherInventoryLabel = response.data;
@@ -698,12 +699,14 @@ const InventoryContainer = Vue.createApp({
                     }
 
                     try {
-                        await axios.post("https://qb-inventory/GiveItem", {
+                        const response = await axios.post("https://qb-inventory/GiveItem", {
                             item: selectedItem,
                             amount: amountToGive,
                             slot: selectedItem.slot,
                             info: selectedItem.info,
                         });
+                        if (!response.data) return;
+
                         this.playerInventory[selectedItem.slot].amount -= amountToGive;
                         if (this.playerInventory[selectedItem.slot].amount === 0) {
                             delete this.playerInventory[selectedItem.slot];

diff --git a/server/main.lua b/server/main.lua
@@ -495,9 +495,12 @@ RegisterNetEvent('qb-inventory:server:SetInventoryData', function(fromInventory,
             end
         else
             if toItem then
-                if RemoveItem(fromId, fromItem.name, fromAmount, fromSlot, 'swapped item') and RemoveItem(toId, toItem.name, toAmount, toSlot, 'swapped item') then
-                    AddItem(toId, fromItem.name, fromAmount, toSlot, fromItem.info, 'swapped item')
-                    AddItem(fromId, toItem.name, toAmount, fromSlot, toItem.info, 'swapped item')
+                local fromItemAmount = fromItem.amount
+                local toItemAmount = toItem.amount
+
+                if RemoveItem(fromId, fromItem.name, fromItemAmount, fromSlot, 'swapped item') and RemoveItem(toId, toItem.name, toItemAmount, toSlot, 'swapped item') then
+                    AddItem(toId, fromItem.name, fromItemAmount, toSlot, fromItem.info, 'swapped item')
+                    AddItem(fromId, toItem.name, toItemAmount, fromSlot, toItem.info, 'swapped item')
                 end
             else
                 if RemoveItem(fromId, fromItem.name, toAmount, fromSlot, 'moved item') then