Description
The compatibility event prison:server:SetJailStatus in 'ridge/compat/server.lua (lines 14-17) sets a player's jail time directly via setJailTime(src, jailTime) with no permission, job, distance or state checks whatsoever. Any player can trigger it with jailTime = 0 and instantly free themselves from prison.
Impact
- Self-release from prison at will
- setJailTime (e.g. 'ridge/server/qb.lua lines 30-46) sets Player(src).state.jailTime and SetMetaData('injail', time) directly - trivial to call with 0
- Bypasses the entire prison system for any player
Fix suggestion
Validate that the source is an active cop/jail admin before allowing a jail status change (similar to the police:server:JailPlayer compat handler which checks utils.isCop(src) and playerDistanceCheck), and only accept values that match the player's actual sentence.
Description
The compatibility event prison:server:SetJailStatus in 'ridge/compat/server.lua (lines 14-17) sets a player's jail time directly via setJailTime(src, jailTime) with no permission, job, distance or state checks whatsoever. Any player can trigger it with jailTime = 0 and instantly free themselves from prison.
Impact
Fix suggestion
Validate that the source is an active cop/jail admin before allowing a jail status change (similar to the police:server:JailPlayer compat handler which checks utils.isCop(src) and playerDistanceCheck), and only accept values that match the player's actual sentence.