https://g1r-mp.com/wiki/index.php?action=history&feed=atom&title=GetEventClientGetEventClient - Revision history2026-09-30T00:03:39ZRevision history for this page on the wikiMediaWiki 1.46.0https://g1r-mp.com/wiki/index.php?title=GetEventClient&diff=968&oldid=prevQCherry: Release 0.1.4 BUILD133 / Protocol 36 and document authenticated event origin2026-09-21T20:37:18Z<p>Release 0.1.4 BUILD133 / Protocol 36 and document authenticated event origin</p>
<p><b>New page</b></p><div>= getEventClient =<br />
'''Server-side. Available since 0.1.4.'''<br />
<br />
Returns the authenticated player ID that initiated the current synchronous request, or nil when no client request context exists.<br />
<br />
== Syntax ==<br />
<syntaxhighlight lang="lua"><br />
local playerId = getEventClient()<br />
</syntaxhighlight><br />
<br />
The value comes from native server context, not the writable Lua <code>client</code> global. It survives synchronous nested <code>triggerEvent</code> and <code>executeCommandHandler</code> calls, including cross-resource calls. Context is restored after handlers, including errors; simultaneous players do not share one persistent sender value.<br />
<br />
== Remote event contract ==<br />
For a direct <code>triggerServerEvent</code> request:<br />
* The first callback argument remains the authenticated sender ID inserted by the server; client arguments follow it.<br />
* <code>source</code> is the sender's player element; <code>sourceResource</code> is nil; <code>eventOrigin</code> is <code>"client"</code>.<br />
* A client-supplied resource name is not a trusted identity.<br />
<br />
For server Lua forwarding, <code>sourceResource</code> identifies the actual server resource and <code>eventOrigin</code> is <code>"resource"</code>. For native server events, origin is <code>"server"</code>. Forwarding does not erase the initiating client. In command handlers, use this function rather than relying on event-only globals.<br />
<br />
<syntaxhighlight lang="lua"><br />
addEvent("shop:buy", true)<br />
addEventHandler("shop:buy", root, function(playerId, productId)<br />
if getEventClient() ~= playerId then return end<br />
-- Validate product ID, player session, permissions, distance, quantity,<br />
-- price, balance and request rate using SERVER state before granting anything.<br />
end)<br />
</syntaxhighlight><br />
<br />
== Security and migration ==<br />
* Leave private events remote-disabled: <code>addEvent(name, false)</code>.<br />
* Remote subscriptions remain global by event name. <code>resourceRoot</code> is not an authorization boundary; use namespaced names and validate every subscriber.<br />
* Timers and asynchronous database/password/HTTP callbacks run later; they normally have nil client context. Capture player ID and a session token before scheduling, then revalidate them and permissions on completion. '''nil is not proof of administrator authority.'''<br />
* Existing handlers authorizing clients by <code>sourceResource.name</code> must migrate to the authenticated sender and server-owned permission checks.<br />
* This does not stop a modified client from requesting an allowed event. It prevents trusting a forged source identity; scripts must still validate the requested operation. Server-installed Lua resources remain trusted.<br />
<br />
See [[TriggerServerEvent]], [[Lua events]] and [[Update 0.1.4]].<br />
<br />
[[Category:Lua Functions]]<br />
[[Category:Server Functions]]<br />
[[Category:Event Functions]]</div>QCherry