🚗 Agency-Garage v1.0.1 — 3-row scrolling list, two critical exploits patched & a cleaner package.
🚗 Agency-Garage
🔒 Security — Free-Vehicle Exploit Patched (critical) • The "take out" action trusted the job-vehicle flag, model and plate sent by the client • A tampered client could spawn ANY vehicle for free at ANY garage • Now fully verified server-side: job vehicles only spawn at a real job garage the player has access to, and only for a model that garage actually lists • The plate is generated server-side — the client's value is never trusted
🔒 Security — Impound Griefing Patched (critical) • The impound event had no permission check — any player could impound anyone's vehicle and set an arbitrary release fee • Now restricted to whitelisted jobs (Config.Impound.allowedJobs, default police / mechanic) or the ACE 'agency.garage.impound' • Release fee is clamped to Config.Impound.maxFee, the depot id is validated, and the event is rate-limited • The server-side export ImpoundVehicle() is unchanged and keeps working for trusted scripts
🔒 Security — Vehicle Locator Hardened • "Locate" now only returns coordinates for a vehicle the requesting player actually owns — no more tracking foreign plates
🪟 Fixed — Vehicle List Scrolling • The list grew endlessly with your vehicle count and got cut off at the bottom — you couldn't scroll to the cars below (same problem in the impound depot) • The list now caps at 3 rows and scrolls cleanly past that, with the styled cyan scrollbar • Few vehicles → the panel shrinks to fit instead of showing a big empty box • Verified across 1080p, 1440p and laptop resolutions
🌐 New — Config Options • Config.Impound.allowedJobs — which jobs may use the in-game impound event • Config.Impound.maxFee — hard cap on a client-requested release fee
🧹 Cleaned — Removed two dead duplicate files (client_main.lua, root app.js) that were never loaded — leaner, more professional package
♻️ Backward Compatible • No database changes — vehicle state still uses the standard state/garage columns • Existing vehicles, garages and phone sync keep working untouched — the new security checks are purely additive
Installation • Overwrite the following files in your existing Agency-Garage folder:
fxmanifest.lua
config.lua
server/main.lua
html/index.html
html/style.css • Delete these leftover files if they exist: client_main.lua and app.js (both in the root folder) • Config note: if you keep your own config.lua, add allowedJobs and maxFee to your Config.Impound block — otherwise the impound event stays locked to ACE only. Set allowedJobs to your server's actual job names (e.g. mechaniker, ambulance). • No database changes required. • Restart the resource via txAdmin or ensure Agency-Garage.
