QBCore Framework

FiveM Releases
,
83

ok, i wish there would be a framework that wouldnt need database.

84

I cant believe you have done me like this :sob: @BM-CUSTOMS

85

since itā€™s just you and your friends have you thought about just using vmenu?

86

very good stuff, but suggest you to change the way your scripts does their database executions.
They way you do iā€™ll put an example bellow, is exploitable ā€¦ ( i wont answer any DM asking how to exploit ā€¦ only to author and how to solve it ).

QBCore.Functions.ExecuteSql(true, "SELECT * FROM `stashitems` WHERE `stash` = '"..stashId.."'",

that way is exploitable.

stash = ā€˜ā€œā€¦stashIdā€¦ā€ā€™"

1 Like
87

All queries will be prepared in an update coming very soon

1 Like
88

While this specific query is not that bad, since stashID is most likely not something a user can type, itā€™s still a textbox SQL injection example.

89

@Kakarot
you should change all of them , you know :slight_smile: iā€™ll help with prs
@CritteR
Im not talking EXACTLY for the one with the stashidā€¦ was the first one on my screen to show what i mean. :slight_smile:

90

ghmattimysql handles it already; hereā€™s a example:
Quite sure you can just port this over easily to the QBCore function, whats the difference anyway?

exports['ghmattimysql']:execute("SELECT * FROM `table` WHERE `key` = @value", {
    ["@value"] = 'a value'
}, function(result)
  -- ...
end)
91

the qbcore function is just a sync wrapper that kash wrote; same as whatā€™s in kashacters. Iā€™ve already spoke to him about the queries and some other exploits but thereā€™s a lot to go through :sweat_smile:

92

we would still be using lambda and few other menus from client side but a basic money script where you could transfer money between players and would have a daily income would make the server much nicer.

93

gottcha i totally understand. I hope you find something to match your needs. From my experience its easy to identify what kind of server you want to create, and really really hard to keep the vision. Racing server slowly evolve to rp servers. for example.

1 Like
94

Thanks for the offer but Iā€™ve already got the changes on my personal files so Iā€™ll be pushing them soon :grin:

95

afaik ghmattimysql already has such a wrapper?

Ye there is allot of them, there is a spreadsheet somewhere, I donā€™t have it anymore, but I guess you can easily google it, or maybe even look around on the forums, iirc it was made by someone called ā€˜NickChillClubā€™.

It has allot of exploitable NUI-callbacks and events.
I think Iā€™ve fixed most of them in my version of QBCore (which Iā€™m not going to PR, since I really opinionated and customized it :grinning_face_with_smiling_eyes:), but I wouldnā€™t be suprised if thereā€™s more xD

96

Whatā€™s involved in being officially recognised?

1 Like
97

Yeah Iā€™m aware, just saying what the function is. To be fair the code might outdate the sync wrapper (not sure when that was added) but thereā€™s really no excuse for the unprepared sql statements and other exploits.

98

In this case it was a matter of the source code being leaked and sold in various places before getting released by one of its creators, and some license issues needing to be dealt with. Doesnā€™t really apply in any other cases.

99

anyone know where to find the seeds for the weed strains?

100

Use the Dealers:P

101

alrighty so the dealers give seeds as rewards and stuff gottcha, what resource controls that?

102

qb-drugs creates the drug delivering thingy :slight_smile:

1 Like