fix(core): patch negative balance exploit, giveammo validation, identity callback guard, and cron drift

[core]/cron/server/main.lua

@@ -30,14 +30,13 @@ end
 ---@param timestamp number
 function OnTime(timestamp)
     local function scheduledAt(job, dayOffset)
-        return os.time({
-            hour = job.h,
-            min = job.m,
-            sec = 0, -- Assuming tasks run at the start of the minute
-            day = os.date("%d", timestamp) + dayOffset,
-            month = os.date("%m", timestamp),
-            year = os.date("%Y", timestamp),
-        })
+        local dateTable = os.date("*t", timestamp)
+        dateTable.hour = job.h
+        dateTable.min = job.m
+        dateTable.sec = 0
+        dateTable.day = dateTable.day + dayOffset
+
+        return os.time(dateTable)
     end
 
     for i = 1, #cronJobs, 1 do
@@ -66,7 +65,10 @@ function Tick()
         lastTimestamp = timestamp
     end
 
-    SetTimeout(60000, Tick)
+    local seconds = tonumber(os.date("%S", timestamp)) or 0
+    local msToNextMinute = math.max(1000, (60 - seconds) * 1000)
+
+    SetTimeout(msToNextMinute, Tick)
 end
 
 lastTimestamp = GetUnixTimestamp()

[core]/es_extended/locales/en.lua

@@ -121,6 +121,7 @@ return {
     ["commanderror_invalidplayerid"] = "Specified Player is not online",
     ["commandgeneric_playerid"] = "Player`s Server Id",
     ["commandgeneric_dimension"] = "Target Dimension",
+    ["command_giveammo"] = "Give ammo to a player",
     ["command_giveammo_noweapon_found"] = "%s does not have that weapon",
     ["command_giveammo_weapon"] = "Weapon name",
     ["command_giveammo_ammo"] = "Ammo Quantity",

[core]/es_extended/locales/es.lua

@@ -119,6 +119,7 @@ return {
     ["commanderror_invalidplayerid"] = "El jugador especificado no está en línea",
     ["commandgeneric_playerid"] = "ID del servidor del jugador",
     ["commandgeneric_dimension"] = "Dimensión de destino",
+    ["command_giveammo"] = "Dar munición a un jugador",
     ["command_giveammo_noweapon_found"] = "%s no tiene esa arma",
     ["command_giveammo_weapon"] = "Nombre del arma",
     ["command_giveammo_ammo"] = "Cantidad de munición",

[core]/es_extended/server/classes/player/accounts.lua

@@ -100,7 +100,8 @@ function Core.PlayerClass.AttachAccounts(self)
 
     function self.removeAccountMoney(accountName, money, reason)
         reason = reason or "Unknown"
-        if not tonumber(money) then
+        money = tonumber(money)
+        if not money then
             error(("Tried To Set Account ^5%s^1 For Player ^5%s^1 To An Invalid Number -> ^5%s^1"):format(accountName, self.playerId, money))
             return
         end
@@ -109,17 +110,16 @@ function Core.PlayerClass.AttachAccounts(self)
 
             if account then
                 money = account.round and ESX.Math.Round(money) or money
-                if self.accounts[account.index].money - money > self.accounts[account.index].money then
-                    error(("Tried To Underflow Account ^5%s^1 For Player ^5%s^1!"):format(accountName, self.playerId))
-                    return
+                if self.accounts[account.index].money - money < 0 then
+                    return false
                 end
                 self.accounts[account.index].money = self.accounts[account.index].money - money
 
                 self.triggerEvent("esx:setAccountMoney", account)
                 TriggerEvent("esx:removeAccountMoney", self.source, accountName, money, reason)
                 return true
             else
-                error(("Tried To Set Add To Invalid Account ^5%s^1 For Player ^5%s^1!"):format(accountName, self.playerId))
+                error(("Tried To Remove From Invalid Account ^5%s^1 For Player ^5%s^1!"):format(accountName, self.playerId))
             end
         else
             error(("Tried To Set Account ^5%s^1 For Player ^5%s^1 To An Invalid Number -> ^5%s^1"):format(accountName, self.playerId, money))

[core]/es_extended/server/modules/commands/registrations/inventory.lua

@@ -84,12 +84,20 @@ if not Config.CustomInventory then
         end,
         true,
         {
-            help = TranslateCap("command_giveweapon"),
-            validate = false,
+            help = TranslateCap("command_giveammo"),
+            validate = true,
             arguments = {
                 { name = "playerId", help = TranslateCap("commandgeneric_playerid"), type = "player" },
                 { name = "weapon", help = TranslateCap("command_giveammo_weapon"), type = "weapon" },
-                { name = "ammo", help = TranslateCap("command_giveammo_ammo"), type = "number" },
+                {
+                    name = "ammo",
+                    help = TranslateCap("command_giveammo_ammo"),
+                    type = "number",
+                    Validator = {
+                        validate = function(x) return x > 0 end,
+                        err = TranslateCap("commanderror_argumentmismatch_positive_number", "ammo")
+                    }
+                },
             },
         }
     )

[core]/esx_identity/server/main.lua

@@ -255,6 +255,10 @@ if not multichar then
 end
 
 xLib.callback.registerCompat("esx_identity:registerIdentity", function(source, cb, data)
+    if type(data) ~= "table" then
+        return cb(false)
+    end
+
     local xPlayer = ESX.Player(source)
 
     if not checkNameFormat(data.firstname) then