ox inventory exploit

[Whisperisgod]

Describe the bug

Items stored in a vehicle's glovebox are duplicated after storing the vehicle in the garage and taking it out again.

If a player places an item in the glovebox, stores the vehicle in the garage, and then retrieves it again, the item is duplicated instead of being saved correctly.

Framework

Qbox

Resource version

(Please replace this with your ox_inventory version from fxmanifest.lua.)

To Reproduce

1. Spawn or take out a vehicle.
2. Open the glovebox and place any item inside.
3. Store the vehicle in the garage.
4. Take the same vehicle out of the garage.
5. Open the glovebox again.
6. The item has been duplicated.

Expected behavior

Items placed inside the glovebox should persist correctly after storing and retrieving the vehicle. No items should be duplicated.

Screenshots

A video demonstrating the issue is attached.

Additional context

This happens consistently when storing a vehicle with items inside the glovebox and then retrieving it from the garage. The attached video shows the duplication occurring.

[Whisperisgod]

version '2.47.8'

[Whisperisgod]

https://streamable.com/5hbf9z
https://streamable.com/7mza9j

[thelindat]

@ChatDisabled

[ChatDisabled]

All I can say is that it doesn't happen on default Qbox.

https://r2.qbox.re/chatty/oxissue1963.mp4

See his second streamable clip. It takes immensely long for the glovebox to load. Why? What is blocking this? @Whisperisgod you'll probably want to look at any custom hooks you have setup or any other custom logic.

[thelindat]

I noticed qbox vehicles uses a query to get the vehicle id from the plate. If the database is getting hit hard then it could also hit a race condition.

I need to look into that old ass issue again that esk0 never resolved. When this issue was originally posted it had completely different content and I thought it was some delay on setting the plate.

[Whisperisgod]

qbx_vehicles...

[Whisperisgod]

When I cut all ties with qbx_vehicles and worked directly with the database, this problem went away.

[ChatDisabled]

https://github.com/Qbox-project/qbx_vehicles/blob/26996493fcbea796950376282c81f6300897fa91/server/main.lua#L210-L212

If one simple ID lookup in your db takes 5+ seconds you're gonna have more problems than this "exploit". The same vehicle literally spawns with 5 different plates in your second clip. You really need to optimize your server Whisper

[Whisperisgod]

https://github.com/Qbox-project/qbx_vehicles/blob/26996493fcbea796950376282c81f6300897fa91/server/main.lua#L210-L212

If one simple ID lookup in your db takes 5+ seconds you're gonna have more problems than this "exploit". The same vehicle literally spawns with 5 different plates in your second clip. You really need to optimize your server Whisper

I took care of the problem