Skip to content

fix: mugshot trigger without auth - any player can force mugshot on anyone#556

Open
peleg-development wants to merge 1 commit into
Project-Sloth:mainfrom
peleg-development:security/fix-critical-vulns
Open

fix: mugshot trigger without auth - any player can force mugshot on anyone#556
peleg-development wants to merge 1 commit into
Project-Sloth:mainfrom
peleg-development:security/fix-critical-vulns

Conversation

@peleg-development

Copy link
Copy Markdown

Security Fixes

Severity Issue File What's wrong Fixed
CRITICAL Mugshot trigger without auth - any player can force mugshot on anyone server/fivemanage.lua:125 triggerSuspectMugshot callback has no CheckAuth() call. Any player can force a mugshot camera trigge...
CRITICAL Photo upload without auth - any player can upload to any suspect profile server/fivemanage.lua:143 uploadSuspectPhoto callback has no CheckAuth() call. Any player can upload arbitrary images to any c...

Fix details

Mugshot trigger without auth - any player can force mugshot on anyone

+    if not CheckAuth(source) then return { success = false, message = 'Unauthorized' } end

Photo upload without auth - any player can upload to any suspect profile

+    if not CheckAuth(source) then return { success = false, message = 'Unauthorized' } end

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant