From 4e8a15590f3a3733647d5a7d2e7c764a47923a7a Mon Sep 17 00:00:00 2001 From: Jim Shield Date: Mon, 5 May 2025 11:44:51 +0100 Subject: [PATCH] make a checkToken() event its own function Several events were calling very similar check token events, so I've just moved them to one to help unify it and help future debugging --- shared/crafting.lua | 13 ++------- shared/itemcontrol.lua | 53 ++++++++++++++++++++++++------------- shared/wrapperfunctions.lua | 10 ++----- 3 files changed, 39 insertions(+), 37 deletions(-) diff --git a/shared/crafting.lua b/shared/crafting.lua index 917983a..2a3fd3d 100644 --- a/shared/crafting.lua +++ b/shared/crafting.lua @@ -441,17 +441,8 @@ RegisterNetEvent(getScript()..":Crafting:GetItem", function(ItemMake, craftable, return end - if token == nil then - debugPrint("^1Auth^7: ^1No token recieved^7") - dupeWarn(src, item, "Auth: Player "..src.." attempted to spawn "..item.." without an auth token") - else - if token ~= validTokens[src] then - debugPrint("^1Auth^7: ^1Tokens don't match! ^7", token, validTokens[src]) - dupeWarn(src, item, "Auth: "..src.." attempted to trigger server only events with an incorrect auth token") - else - debugPrint("^1Auth^7: ^2Client and Server Auth tokens match^7!", token, validTokens[src]) - validTokens[src] = nil - end + if not checkToken(src, token, "item", ItemMake) then + return end diff --git a/shared/itemcontrol.lua b/shared/itemcontrol.lua index aaf0bb7..28e31b3 100644 --- a/shared/itemcontrol.lua +++ b/shared/itemcontrol.lua @@ -179,7 +179,7 @@ end --- TriggerServerEvent(getScript()..":server:toggleItem", true, "health_potion", 1) --- ``` RegisterNetEvent(getScript()..":server:toggleItem", function(give, item, amount, newsrc, info, slot, token) - debugPrint(GetInvokingResource()) + --debugPrint(GetInvokingResource()) if GetInvokingResource() and GetInvokingResource() ~= getScript() and GetInvokingResource() ~= "qb-core" then debugPrint("^1Error^7: ^1Possible exploit^7, ^1vital function was called from an external resource^7") return @@ -191,21 +191,9 @@ RegisterNetEvent(getScript()..":server:toggleItem", function(give, item, amount, local src = newsrc or source if (give == true or give == 1) then - if newsrc == nil then -- must be coming from client this would be blank - if token == nil then - debugPrint("^1Auth^7: ^1No token recieved^7") - dupeWarn(src, item, "^1Auth Error^7: ^3"..src.." ^1attempted to spawn ^7"..item.." ^1without an auth token^7") - else - if type(token) ~= "number" then -- checks if the newsrc is a source or token, if number its coming form the server itself - debugPrint("^1Auth^7: ^2Auth token received^7, ^2checking against server cache^7..") - if token ~= validTokens[src] then - debugPrint("^1Auth^7: ^1Tokens don't match! ^7", token, validTokens[src]) - dupeWarn(src, item, "^1Auth Error^7: ^3"..src.." ^1attempted to spawn ^7"..item.." ^1with an incorrect auth token^7") - else - debugPrint("^1Auth^7: ^2Client and Server Auth tokens match^7!", token, validTokens[src]) - validTokens[src] = nil - end - end + if newsrc == nil then -- this must be coming from client this would be blank + if not checkToken(src, token, "item", item) then + return end end end @@ -716,7 +704,7 @@ if isServer() then createCallback(AuthEvent, function(source) local src = source local token = keyGen()..keyGen()..keyGen()..keyGen() -- Use a secure random generator here - debugPrint(GetInvokingResource()) + --debugPrint(GetInvokingResource()) if GetInvokingResource() and GetInvokingResource() ~= getScript() and GetInvokingResource() ~= "qb-core" then debugPrint("^1Error^7: ^1Possible exploit^7, ^1vital function was called from an external resource^7") return "" @@ -748,7 +736,7 @@ if isServer() then receivedEvent = {} createCallback(getScript()..":callback:GetAuthEvent", function(source) local src = source - debugPrint(GetInvokingResource()) + --debugPrint(GetInvokingResource()) if GetInvokingResource() and GetInvokingResource() ~= getScript() and GetInvokingResource() ~= "qb-core" then debugPrint("^1Error^7: ^1Possible exploit^7, ^1vital callback was called from an external resource^7") return "" @@ -761,9 +749,38 @@ if isServer() then return "" end end) + + -- Multiuse function to check if the generated client token is valid + function checkToken(src, token, genType, name) + if token == nil then + debugPrint("^1Auth^7: ^1No token recieved^7") + if genType == "stash" then + dupeWarn(src, name, "^1Auth Error^7: ^3"..src.." ^1create a stash ^7"..name.." ^1without an auth token^7") + elseif genType == "item" then + dupeWarn(src, name, "^1Auth Error^7: ^3"..src.." ^1attempted to spawn an item ^7"..name.." ^1without an auth token^7") + end + return false + else + debugPrint("^1Auth^7: ^2Auth token received^7, ^2checking against server cache^7..") + if token ~= validTokens[src] then + debugPrint("^1Auth^7: ^1Tokens don't match! ^7", token, validTokens[src]) + if genType == "stash" then + dupeWarn(src, name, "^1Auth Error^7: ^3"..src.." ^1create a stash ^7"..name.." ^1with an incorrect auth token^7") + elseif genType == "item" then + dupeWarn(src, name, "^1Auth Error^7: ^3"..src.." ^1attempted to spawn an item ^7"..name.." ^1with an incorrect auth token^7") + end + return false + else + debugPrint("^1Auth^7: ^2Client and Server Auth tokens match^7!", token, validTokens[src]) + validTokens[src] = nil + return true + end + end + end else onPlayerLoaded(function() debugPrint("^1Auth^7: ^2Requesting ^3Auth Event^7") AuthEvent = triggerCallback(getScript()..":callback:GetAuthEvent") end, true) end + diff --git a/shared/wrapperfunctions.lua b/shared/wrapperfunctions.lua index 5956198..ebed372 100644 --- a/shared/wrapperfunctions.lua +++ b/shared/wrapperfunctions.lua @@ -105,14 +105,8 @@ if isServer() then RegisterNetEvent(getScript()..":server:makeOXStash", function(name, label, slots, weight, owner, coords, token) local src = source or nil if src then - debugPrint("^1Auth^7: ^2Auth token received^7, ^2checking against server cache^7..") - if token == nil then - debugPrint("^1Auth^7: ^1Token not received^7") - elseif token ~= validTokens[src] then - debugPrint("^1Auth^7: ^1Tokens don't match! ^7", token, validTokens[src]) - else - debugPrint("^1Auth^7: ^2Client and Server Auth tokens match^7!", token, validTokens[src]) - validTokens[src] = nil + if not checkToken(src, token, "stash", name) then + return end end