v1.6.0 minor
Quasar Matrix, server-side permission checks and per-job tablet content
MINOR SecurityHigh priority
Oct 27, 2026Script Police Creator
What changed
23changes
Quasar Matrix, server-side permission checks and per-job tablet content
23changes
[02] Release
Quasar Matrix arrives: share and install department setups, penal codes, station locations, tablet themes, lightbar presets, award catalogues and radio plans with other servers, from Admin → Quasar Matrix. The server now checks the MDT module behind every citizen, licence, report, fine and evidence action, closing an SQL injection and several ways for any player to grant licences, write fines or change outfit lockers. Jobs can hide tablet blocks, manage only some licences and rename labels, shops, garages and dealers can require duty and licences, fined citizens are told, and the tablet prop, copy buttons, off-duty blips and CARNOTFOUND names are fixed.
Replace every file in the resource. Over a hundred files changed across the Lua, the NUI and all fifteen translations, and fxmanifest.lua loads new folders — drop the whole folder in.
What to keep from your current install: anything you edited under config/ and custom/. This release changes files in both folders, so merge your edits into the new copy of these rather than keeping your old file:
config/client/radar.lua — new Config.Radar (range, detection angle)config/shared/rpol.lua — new Config.RPOL.ChatFormatserver/custom/framework/qb.lua, qbx.lua, esx.lua — fines now go through one shared function; ESX GetJob also returns the job labelNew files, nothing to merge:
qs-matrix/ — the Quasar Matrix kit (shared by every Quasar script; replaced whole on update)server/matrix/ — what this script shares through Quasar Matrixclient/modules/matrix/ — the page's link to the serverconfig/client/tablet.lua — the tablet prop and animationconfig/client/vehicles.lua — names for addon cars that showed as CARNOTFOUNDconfig/server/penalties.lua — fine noticesAdmin → Quasar Matrix browses what other servers shared for Police Creator and installs it through the same checks as the admin pages — nothing from the hub reaches your database unvalidated, and every place, job, grade, item and model is mapped onto your server in the install wizard. Seven kinds of content: department setups, penal codes, station locations, tablet themes, lightbar presets (needs qs-police-veh-creator), award catalogues and radio & chat plans.
Browsing and installing work straight away. To publish, link the server once from the Connection tab; every Quasar script on the server shares that link. The in-game updater now also sends a hash of sv_licenseKeyToken (never the token itself), so a server keeps its Quasar Matrix link when its host or IP changes.
The full guide is docs/quasar-matrix.md.
The tablet always hid a screen from a job without its module, but the server answered anyone who called it by name. It now holds every citizen, licence, note, fine, report and evidence action to the same module the tablet opens that screen with, and outfit locker and job wardrobe changes to the admin and the grades allowed to manage a locker. Officers using the tablet as usual see no difference. A script of yours that called these callbacks for a job without the module will now be refused.
config/server/penalties.lua: the notice to a fined citizen is on by default; the unpaid-fines reminder on join is off.The tablet in the officer's hand is now the base-game prop_cs_tablet. The old qs-tablet-police model is no longer used; any copy left in a hand by an older version is removed.
qs-police-creator:server:penaltyCreated for every new fine.IsTabletOpen() and client event qs-police-creator:client:tabletToggled.Both are in docs/developer-api/.
Nothing to import.
208 new strings in all fifteen languages. The in-game locale updater overwrites locale files from Weblate — keep hand edits somewhere else.
The evidence ids sent by the client were pasted into the SQL text, so any player could run their own SQL against the database. The ids are now validated as whole numbers and bound as parameters, and the lookup requires the Reports module.
Granting and removing licences, the wanted and dangerous flags, profile photos, notes and deleting a citizen record answered any client. They now require the Citizens module (photos also Agents), notes are deleted only within the caller's job, and deleting a citizen record is admin-only.
Any client could write a fine for anyone, and the total and months were whatever it sent, a negative total included. Writing a fine now needs the Citizens or Penalties module, totals are summed on the server, and penal-code articles take their amounts from the penal code.
A report could be opened, edited or deleted by id from any job, and any job's fines could be read by asking for them. Reports now need the Reports module and must belong to a job the caller's search lists; another job's fines need the Penalties module. A player's own fines stay open for the billing desk.
Buying from a shop had no server-side check, so any client could buy from any shop by id. The server now applies the job and rank rule the shop menu already used.
Adding, editing and deleting outfit lockers and a job's wardrobe answered any client. Lockers and the wardrobe as a whole are now admin-only, and an officer may change their job's outfits only with a grade allowed to manage one of that job's lockers.
Admin → Quasar Matrix: browse what other servers shared and install it, or publish your own. Department setups, penal codes, station locations, tablet themes, lightbar presets, award catalogues and radio & chat plans, each previewed and installed through the same validation as the admin pages, with every place, job, grade, item and model mapped onto your server.
Admin → Dispatch → a job → Tablet content. Hide wanted, dangerous, weapons, vehicles, fines, licences or bank on the citizen profile, and victims, implicated, vehicles or evidence on reports. Hidden blocks are also withheld by the server, and a report saved by that job keeps what its hidden blocks held.
In the same Tablet content card: manage every licence (as before), only a chosen list, or none. Licences a job cannot manage show as held or not held, without buttons, and the server enforces the same rule.
A hospital can read Bills where the police read Fines. The renames apply to that job only, in the server's language, and are undone when the officer changes job.
Logging out used to take the officer off their callsign. They now keep it until /leavecallsign, a supervisor removes it, or they leave the dispatch jobs.
The prop was deleted without taking network control of it, so once ownership moved to a nearby player it stayed in the hand for everyone. Closing now takes control first and removes every tablet attached to the player; a restart with the tablet open cleans up too.
Going off duty left some call blips behind, and new calls could still draw them. Every call blip is now removed when the officer goes off duty or leaves the job, and none are drawn until they are back on duty.
Copying a dispatch call's coordinates or id, and an operative plan, failed in game because the game's browser blocks the page's clipboard. The client now copies the text, so the buttons work in game as they did in a browser.
The radar read the model of a locked car only after that car had left, so it came back as CARNOTFOUND. The name is now read when the car is detected. Addon cars without a gameName show their spawn name, or a name you set in config/client/vehicles.lua.
On top of job and rank, a point can require being on duty and holding licences granted from the citizen profile. A shop item can require a licence of its own and is hidden from those without it. Nothing changes until you set it.
The fined citizen gets an on-screen notice with the amount, the department and the charge. The server event qs-police-creator:server:penaltyCreated carries the whole fine for phone or billing scripts. An optional reminder of unpaid fines on join is in config/server/penalties.lua.
Config.RPOL.ChatFormat with {{assignment}} (the officer's MDT radio frequency, e.g. DISPATCH), {{callsign}}, {{rank}}, {{job}}, {{name}} and {{message}}. Empty placeholders drop their brackets. The default is the old format.
Config.Radar in config/client/radar.lua sets the range, the beam width and how far Opposite mode turns. The defaults match the old values.
Client export IsTabletOpen() and event qs-police-creator:client:tabletToggled. The prop is now the base-game prop_cs_tablet, with model, animation and placement in config/client/tablet.lua.
Tags were saved but never searched. The search now matches tags as well, a report number search no longer shows zero pages, and typing % or _ no longer lists every report.
Each keystroke rebuilt the frequency's id, which remounted the row under the cursor. Admin → Communication → Radio channels now keeps the field focused while typing.
The radar always started in km/h whatever the config said. The config value is now the default when the player has not chosen units on the radar remote.