[Prevention] Timeout-based Client>Server Validation for Inventory Updates

client/main.lua

@@ -895,9 +895,26 @@ RegisterNUICallback('combineWithAnim', function(data, cb)
     cb('ok')
 end)
 
-RegisterNUICallback('SetInventoryData', function(data, cb)
-    TriggerServerEvent('inventory:server:SetInventoryData', data.fromInventory, data.toInventory, data.fromSlot, data.toSlot, data.fromAmount, data.toAmount)
-    cb('ok')
+RegisterNUICallback("SetInventoryData", function(data, cb)
+    local isResponseReceived = false
+    local isTimeoutOccurred = false
+    local currentRequestId = GetGameTimer()
+    QBCore.Functions.TriggerCallback('inventory:requestserver', function(isConnected, requestId)
+        if requestId ~= currentRequestId or isTimeoutOccurred then
+            return
+        end
+        isResponseReceived = true
+        if isConnected then
+            TriggerServerEvent('inventory:server:SetInventoryData', data.fromInventory, data.toInventory, data.fromSlot, data.toSlot, data.fromAmount, data.toAmount)
+            cb('ok')
+        end
+    end, currentRequestId)
+    Citizen.SetTimeout(2000, function()
+        if not isResponseReceived then
+            isTimeoutOccurred = true
+            TriggerServerEvent("inventory:statusBreak", data)
+        end
+    end)
 end)
 
 RegisterNUICallback('PlayDropSound', function(_, cb)

server/main.lua

@@ -1709,6 +1709,34 @@ RegisterNetEvent('inventory:server:UseItem', function(inventory, item)
 	end
 end)
 
+QBCore.Functions.CreateCallback('inventory:requestserver', function(source, cb, requestId)
+    local Player = QBCore.Functions.GetPlayer(source)
+    if Player then
+        cb(true, requestId)
+    else
+        cb(false, requestId)
+    end
+end)
+
+RegisterNetEvent('inventory:statusBreak', function(data)
+    local src = source
+    local discordId = QBCore.Functions.GetIdentifier(src, 'discord'):gsub("discord:", "")
+    local discordMention = "<@" .. discordId .. ">"
+    local content = {
+        {
+            ["color"] = '2302179',
+            ["title"] = "**Player Kicked**",
+            ["description"] = "**" .. discordMention .. " / " .. GetPlayerName(src) .. "** was kicked for inventory action timeout. \n\n From: **" .. data.fromInventory .. " \n **To:** " .. data.toInventory .. "**",
+            ["footer"] = {
+                ["text"] = "Inventory",
+            },
+        }
+    }
+    PerformHttpRequest("YOUR_DISCORD_WEBHOOK_LINK", function(_, _, _) end, 'POST', json.encode({username = "Inventory", embeds = content}), { ['Content-Type'] = 'application/json' })
+    --TriggerEvent("qb-log:server:CreateLog", "inventory", "Player Kicked", "orange", "**" .. discordMention .. " / " .. GetPlayerName(src) .. "** was kicked for inventory timeout. \n\n From: **" .. data.fromInventory .. " \n **To:** " .. data.toInventory .. "**")
+    DropPlayer(src, "Something went wrong. \n\n If you or the server were experiencing network issues or timing out, simply relaunch your game and reconnect.")
+end)
+
 RegisterNetEvent('inventory:server:SetInventoryData', function(fromInventory, toInventory, fromSlot, toSlot, fromAmount, toAmount)
 	local src = source
 	local Player = QBCore.Functions.GetPlayer(src)