Zum Hauptinhalt springen

v1.1.1

Security hardening: the fuel value became server-authoritative and every event gained a proximity check.

Security​

  • Server-authoritative fuel: a StateBag change handler tracks the authorized fuel value per vehicle and rolls back any illegitimate increase, so a client can no longer set arbitrary fuel levels
  • GetVehicleFuel falls back to 0.0 instead of 50.0, so a missing fuel state can no longer grant free fuel
  • Serverside rate limiting (500 ms) on refillCan, payFuelPrice and updateFuelCan
  • Petrolcan buy and refill verify serverside that the player is actually standing at a known fuel station, which blocks spoofed coordinates and remote triggering

Added​

  • Per vehicle type fueling distance via Config.MaxFuelingDistance (default, heli, plane) plus a serverside GetMaxFuelingDistance helper
  • Serverside IsPlayerNearFuelStation check with Config.MaxStationDistance and Config.FuelStationZoneDistance
  • Translation fallback: a missing key falls back to English and then to the raw key instead of throwing an error

Changed​

  • Config.Debug now defaults to false
  • Config.MaxFuelingDistance changed from a single number to a per vehicle type table
  • Money handling in the petrolcan and refuel events is unified on PayPrice
  • Relicensed the resource to LGPL-3.0-or-later

Fixed​

  • Adjusted the wrong fuel engine failure threshold (now triggers below 500 engine health)
  • Clean up the authorized fuel and rate limit tables on entityRemoved and playerDropped

Changed files​

client/fuel.lua
client/functions.lua
client/main.lua
config.lua
server/functions.lua
server/main.lua
server/versionchecker.lua
translation.lua
fxmanifest.lua
LICENSE, GPL-3.0.txt, .gitignore