From 7533a02317b3daa2408b8bd856d5a12c6b5541d2 Mon Sep 17 00:00:00 2001
From: poco <107696090+poco8537@users.noreply.github.com>
Date: Tue, 10 Sep 2024 17:52:14 +0900
Subject: [PATCH] security: Updated permission checks for weather, cloud, and
 time modification functions

---
 vMenuServer/MainServer.cs | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/vMenuServer/MainServer.cs b/vMenuServer/MainServer.cs
index 9523c599..d6069be1 100644
--- a/vMenuServer/MainServer.cs
+++ b/vMenuServer/MainServer.cs
@@ -660,8 +660,13 @@ private void RefreshWeather()
         /// <param name="blackoutNew"></param>
         /// <param name="dynamicWeatherNew"></param>
         [EventHandler("vMenu:UpdateServerWeather")]
-        internal void UpdateWeather(string newWeather, bool blackoutNew, bool dynamicWeatherNew, bool enableSnow)
+        internal void UpdateWeather([FromSource] Player source, string newWeather, bool blackoutNew, bool dynamicWeatherNew, bool enableSnow)
         {
+            if (source != null && !IsPlayerAceAllowed(source.Handle, "vMenu.WeatherOptions.Menu") && !IsPlayerAceAllowed(source.Handle, "vMenu.WeatherOptions.All"))
+            {
+                BanManager.BanCheater(source);
+                return;
+            }
 
             // Automatically enable snow effects whenever one of the snow weather types is selected.
             if (newWeather is "XMAS" or "SNOWLIGHT" or "SNOW" or "BLIZZARD")
@@ -684,8 +689,14 @@ internal void UpdateWeather(string newWeather, bool blackoutNew, bool dynamicWea
         /// </summary>
         /// <param name="removeClouds"></param>
         [EventHandler("vMenu:UpdateServerWeatherCloudsType")]
-        internal void UpdateWeatherCloudsType(bool removeClouds)
+        internal void UpdateWeatherCloudsType([FromSource] Player source, bool removeClouds)
         {
+            if (source != null && !IsPlayerAceAllowed(source.Handle, "vMenu.WeatherOptions.RemoveClouds") && !IsPlayerAceAllowed(source.Handle, "vMenu.WeatherOptions.RandomizeClouds"))
+            {
+                BanManager.BanCheater(source);
+                return;
+            }
+
             if (removeClouds)
             {
                 TriggerClientEvent("vMenu:SetClouds", 0f, "removed");
@@ -705,8 +716,14 @@ internal void UpdateWeatherCloudsType(bool removeClouds)
         /// <param name="newMinutes"></param>
         /// <param name="freezeTimeNew"></param>
         [EventHandler("vMenu:UpdateServerTime")]
-        internal void UpdateTime(int newHours, int newMinutes, bool freezeTimeNew)
+        internal void UpdateTime([FromSource] Player source, int newHours, int newMinutes, bool freezeTimeNew)
         {
+            if (source != null && !IsPlayerAceAllowed(source.Handle, "vMenu.TimeOptions.Menu") && !IsPlayerAceAllowed(source.Handle, "vMenu.TimeOptions.All"))
+            {
+                BanManager.BanCheater(source);
+                return;
+            }
+
             CurrentHours = newHours;
             CurrentMinutes = newMinutes;
             FreezeTime = freezeTimeNew;