sql injection fix

and some cleanup
FiveEYZ · May 6, 2020 · 8d45ce7 · 8d45ce7
1 parent 44e3f89
commit 8d45ce7
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 16 deletions.
diff --git a/esx_kashacters/html/js/app.js b/esx_kashacters/html/js/app.js
@@ -41,15 +41,15 @@ $(".character-box").click(function () {
 
 $("#play-char").click(function () {
     $.post("http://esx_kashacters/CharacterChosen", JSON.stringify({
-        charid: $('.active-char').attr("data-charid"),
-        ischar: $('.active-char').attr("data-ischar"),
+        charid: Number($('.active-char').attr("data-charid")),
+        ischar: ($('.active-char').attr("data-ischar") == "true"),
     }));
     Kashacter.CloseUI();
 });
 
 $("#deletechar").click(function () {
     $.post("http://esx_kashacters/DeleteCharacter", JSON.stringify({
-        charid: $('.active-char').attr("data-charid"),
+        charid: Number($('.active-char').attr("data-charid")),
     }));
     Kashacter.CloseUI();
 });

diff --git a/esx_kashacters/server/main.lua b/esx_kashacters/server/main.lua
@@ -13,12 +13,14 @@ local IdentifierTables = {
     {table = "phone_messages", column = "owner"},
     {table = "private_vehicles", column = "owner"},
     {table = "rented_vehicles", column = "owner"},
+	{table = "user_documents", column = "owner"},
 	{table = "user_licenses", column = "owner"},
     {table = "billing", column = "identifier"},
     {table = "crimerecord", column = "identifier"},
     {table = "phone_users_contacts", column = "identifier"},
     {table = "society_moneywash", column = "identifier"},
     {table = "users", column = "identifier"},
+	{table = "invest", column = "identifier"},
 	{table = "twitter_tweets", column = "realUser"}
 }
 
@@ -35,20 +37,20 @@ end)
 RegisterServerEvent("kashactersS:CharacterChosen")
 AddEventHandler('kashactersS:CharacterChosen', function(charid, ischar)
     local src = source
---    local spawn = {}
+
 	local isnew = true
-    SetLastCharacter(src, tonumber(charid))
-    SetCharToIdentifier(GetPlayerIdentifiers(src)[2], tonumber(charid))
-    if ischar == "true" then
-		isnew = false
-        --spawn = GetSpawnPos(src)
-		--TriggerClientEvent("kashactersC:SpawnCharacter", src, spawn)
-    else
-		TriggerClientEvent('skinchanger:loadDefaultModel', src, true, cb)
-		--TriggerEvent('esx_identity:showRegisterIdentity')
-		--TriggerClientEvent("kashactersC:SpawnCharacter", src, spawn)
-    end
-    TriggerClientEvent("kashactersC:SpawnCharacter", src, isnew)
+	if type(charid) == "number" and type(ischar) == "boolean" then
+		SetLastCharacter(src, charid)
+		SetCharToIdentifier(GetPlayerIdentifiers(src)[2], charid)
+		if ischar == true then
+			isnew = false
+		else
+			TriggerClientEvent('skinchanger:loadDefaultModel', src, isnew, cb)
+		end
+		TriggerClientEvent("kashactersC:SpawnCharacter", src, isnew)
+	else
+		-- Trigger Ban Event here to ban individuals trying to use SQL Injections
+	end
 end)
 
 RegisterServerEvent("kashactersS:DeleteCharacter")