From 59ff34c9cc51add286994ecb98c80a20c8fa81f7 Mon Sep 17 00:00:00 2001
From: Jim Shield <gothicjim@gmail.com>
Date: Thu, 1 May 2025 18:07:39 +0100
Subject: [PATCH] Add exploit protection for `:Crafting:GetItem`

I unfortunately forgot to add this before when adding the extra exploit protection. Now demands an auth token before allowing crafting results to help reduce exploiters calling it externally
---
 shared/crafting.lua     | 26 ++++++++++++++++++++++++--
 shared/metaHandlers.lua | 13 +++++++++++++
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/shared/crafting.lua b/shared/crafting.lua
index 334667d..917983a 100644
--- a/shared/crafting.lua
+++ b/shared/crafting.lua
@@ -371,8 +371,10 @@ function makeItem(data)
                             anim = anim,
                             flag = 49,
                             icon = data.item,
+                            request = true,
                         }) then
-                            TriggerServerEvent(getScript()..":Crafting:GetItem", data.item, data.craft, data.stashName, metadata)
+                            TriggerServerEvent(getScript()..":Crafting:GetItem", data.item, data.craft, data.stashName, metadata, currentToken)
+                            currentToken = nil -- clear client cached token
                             CreateThread(function()
                                 if data.craft["hasCrafted"] ~= nil then
                                     debugPrint("hasCrafted Found, marking '"..data.item.."' as crafted for player")
@@ -431,8 +433,28 @@ end
 --- @param stashName string|table The stash name(s) to remove ingredients from.
 --- @param metadata table (optional) Metadata for the crafted item.
 --- @usage
-RegisterNetEvent(getScript()..":Crafting:GetItem", function(ItemMake, craftable, stashName, metadata)
+RegisterNetEvent(getScript()..":Crafting:GetItem", function(ItemMake, craftable, stashName, metadata, token)
     local src = source
+    debugPrint(GetInvokingResource())
+	if GetInvokingResource() and GetInvokingResource() ~= getScript() and GetInvokingResource() ~= "qb-core" then
+        debugPrint("^1Error^7: ^1Possible exploit^7, ^1vital function was called from an external resource^7")
+        return
+    end
+
+    if token == nil then
+        debugPrint("^1Auth^7: ^1No token recieved^7")
+        dupeWarn(src, item, "Auth: Player "..src.." attempted to spawn "..item.." without an auth token")
+    else
+        if token ~= validTokens[src] then
+            debugPrint("^1Auth^7: ^1Tokens don't match! ^7", token, validTokens[src])
+            dupeWarn(src, item, "Auth: "..src.." attempted to trigger server only events with an incorrect auth token")
+        else
+            debugPrint("^1Auth^7: ^2Client and Server Auth tokens match^7!", token, validTokens[src])
+            validTokens[src] = nil
+        end
+    end
+
+
     local hasItems, hasTable = hasItem(ItemMake, 1, src)
     if stashName then
         local itemRemove = {}
diff --git a/shared/metaHandlers.lua b/shared/metaHandlers.lua
index 56273f1..9d6160f 100644
--- a/shared/metaHandlers.lua
+++ b/shared/metaHandlers.lua
@@ -23,18 +23,23 @@ function GetPlayer(source)
     if isStarted(QBExport) then
         debugPrint("^6Bridge^7: ^3GetPlayer^7() QBExport")
         return exports[QBExport]:GetCoreObject().Functions.GetPlayer(source)
+
     elseif isStarted(QBXExport) then
         debugPrint("^6Bridge^7: ^3GetPlayer^7() QBOXExport")
         return exports[QBXExport]:GetCoreObject().Functions.GetPlayer(source)
+
     elseif isStarted(ESXExport) then
         debugPrint("^6Bridge^7: ^3GetPlayer^7() ESXExport")
         return ESX.GetPlayerFromId(source)
+
     elseif isStarted(OXCoreExport) then
         debugPrint("^6Bridge^7: ^3GetPlayer^7() OXCoreExport")
         return exports[OXCoreExport]:GetPlayer(source)
+
     elseif isStarted(RSGExport) then
         debugPrint("^6Bridge^7: ^3GetPlayer^7() RSGExport")
         return exports[RSGExport]:GetCoreObject().Functions.GetPlayer(source)
+
     end
     return nil
 end
@@ -63,15 +68,19 @@ function GetMetadata(player, key)
         if isStarted(QBExport) or isStarted(QBXExport) then
             debugPrint("^6Bridge^7: ^3GetMetadata^7() QBExport/QBXExport", key)
             return player.PlayerData.metadata[key]
+
         elseif isStarted(ESXExport) then
             debugPrint("^6Bridge^7: ^3GetMetadata^7() ESXExport", key)
             return player.getMeta(key)
+
         elseif isStarted(OXCoreExport) then
             debugPrint("^6Bridge^7: ^3GetMetadata^7() OXCoreExport", key)
             return player.get(key)
+
         elseif isStarted(RSGExport) then
             debugPrint("^6Bridge^7: ^3GetMetadata^7() RSGExport", key)
             return player.PlayerData.metadata[key]
+
         end
     end
     return nil
@@ -118,15 +127,19 @@ function SetMetadata(player, key, value)
     if isStarted(QBExport) or isStarted(QBXExport) then
         debugPrint("^6Bridge^7: ^3SetMetadata^7() using QBExport/QBXExport")
         player.Functions.SetMetaData(key, value)
+
     elseif isStarted(ESXExport) then
         debugPrint("^6Bridge^7: ^3SetMetadata^7() using ESXExport")
         player.setMeta(key, value)
+
     elseif isStarted(OXCoreExport) then
         debugPrint("^6Bridge^7: ^3SetMetadata^7() using OXCoreExport")
         player.set(key, value)
+
     elseif isStarted(RSGExport) then
         debugPrint("^6Bridge^7: ^3SetMetadata^7() using RSGExport")
         player.Functions.SetMetaData(key, value)
+
     end
 end