From 807cfe1a2a3d84911a027ced25a9f52fc52f132e Mon Sep 17 00:00:00 2001
From: Jim Shield <gothicjim@gmail.com>
Date: Sat, 13 Sep 2025 02:50:31 +0100
Subject: [PATCH] Fix stash dist exploit checker

---
 shared/_authToken.lua  |  7 ++++++-
 shared/itemcontrol.lua | 23 ++++++++++++-----------
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/shared/_authToken.lua b/shared/_authToken.lua
index d114746..6b97c72 100644
--- a/shared/_authToken.lua
+++ b/shared/_authToken.lua
@@ -1,6 +1,8 @@
 -------------------------------------------------------------
 -- Exploit Auth System
 -------------------------------------------------------------
+
+forceDisableExplotProtection = false -- dangerous, this allows exploits
 AuthEvent = nil
 currentToken = nil
 if isServer() then
@@ -81,6 +83,8 @@ if isServer() then
 
     -- Multiuse function to check if the generated client token is valid
     function checkToken(src, token, genType, name)
+        if forceDisableExplotProtection == true then return true end
+
         if token == nil then
             debugPrint("^1Auth^7: ^1No token recieved^7")
             if genType == "stash" then
@@ -119,6 +123,7 @@ else
 end
 
 function distExploitCheck(table, src)
+    if forceDisableExplotProtection == true then return true end
 
     if not table then
         print("^1Error^7: ^1This wasn^7'^1t reigstered correctly or this is an exploit attempt^1")
@@ -130,7 +135,7 @@ function distExploitCheck(table, src)
     local allow = false
 
     for i = 1, #table do
-        if #(table[i]  - srcCoords) <= 10 then
+        if #(table[i].xyz  - srcCoords) <= 10 then
             return true
         else
             allow = false
diff --git a/shared/itemcontrol.lua b/shared/itemcontrol.lua
index c56cd55..a904e2f 100644
--- a/shared/itemcontrol.lua
+++ b/shared/itemcontrol.lua
@@ -1670,7 +1670,6 @@ end
 --- ```lua
 --- useToolDegrade({ item = "drill", maxUse = 10 })
 --- ```
-
 function useToolDegrade(data) -- WIP
     local metadata, slot = getItemMetadata(data.item)
     metadata = metadata or {}
@@ -1752,7 +1751,7 @@ end)
 --- ```lua
 --- getRandomReward("gold_ring")
 --- ```
-function getRandomReward(itemName)
+function getRandomReward(itemName, src)
     if Config.Rewards.RewardPool then
         local reward = false
         if type(Config.Rewards.RewardItem) == "string" then
@@ -1765,7 +1764,6 @@ function getRandomReward(itemName)
             end
         end
         if reward then
-            removeItem(itemName, 1)
             local totalRarity = 0
             for i = 1, #Config.Rewards.RewardPool do
                 totalRarity += Config.Rewards.RewardPool[i].rarity
@@ -1778,7 +1776,7 @@ function getRandomReward(itemName)
                 currentRarity += Config.Rewards.RewardPool[i].rarity
                 if randomNum <= currentRarity then
                     debugPrint("^6Bridge^7: ^3getRandomReward^7: ^2Selected toy ^7'^6"..Config.Rewards.RewardPool[i].item.."^7'")
-                    addItem(Config.Rewards.RewardPool[i].item, 1)
+                    addItem(Config.Rewards.RewardPool[i].item, 1, nil, src)
                     return
                 end
             end
@@ -2106,7 +2104,10 @@ end
 function openStash(data)
     if (data.job or data.gang) and not jobCheck(data.job or data.gang) then return end
 
-    local exploitCheck = triggerCallback(getScript()..":getRegisteredStashLocations", data.stash)
+    local p = promise.new()
+    p:resolve(triggerCallback(getScript()..":getRegisteredStashLocations", data.stash))
+    local exploitCheck = Citizen.Await(p)
+
     if not exploitCheck then
         print("^3Warning^7: ^2This isn't a registered stash^1, refusing call^7")
         return
@@ -2350,6 +2351,12 @@ end
 --- )
 --- ```
 function registerStash(name, label, slots, weight, owner, coords)
+    if coords then
+        stashExploitCheck[name] = stashExploitCheck[name] or {}
+        stashExploitCheck[name][#stashExploitCheck[name]+1] = coords
+    else
+        print("^3Warning^7: ^1Stash ^4"..name.." ^1doesn^7'^1t have coords^7, ^1this is exploitable^7, ^1add coords to ^3regiterStash^7()")
+    end
     for i = 1, #InvFunc do
         local inv = InvFunc[i]
         if isStarted(inv.invName) then
@@ -2357,12 +2364,6 @@ function registerStash(name, label, slots, weight, owner, coords)
             return
         end
     end
-    if coords then
-        stashExploitCheck[name] = stashExploitCheck[name] or {}
-        stashExploitCheck[name][#stashExploitCheck[name]+1] = coords
-    else
-        print("^3Warning^7: ^1Stash ^4"..name.." ^1doesn^7'^1t have coords^7, ^1this is exploitable^7, ^1add coords to ^3regiterStash^7()")
-    end
 end
 
 if isServer() then