v2.1.7 patch
Treasury on the society account, working grade permissions and security fixes
Patch SecurityHigh priority
Nov 13, 2026Script Job Management + Multijob
What changed
21changes
Treasury on the society account, working grade permissions and security fixes
21changes
[02] Release
A security update. Players can no longer give themselves jobs or act on contracts and chats that aren't theirs. On ESX the treasury now uses the job's society account, so invoices from billing scripts show up in it, and permissions given to a grade now work.
data/*.json, bosses.json and hrlog.json hold your server's data: treasury balances (on QB, Qbox, or ESX without esx_addonaccount), salaries, grade permissions, contracts, boss locations and the HR log. The download ships them empty. Do not copy them over yours.qs-job-management.sql only creates its table if it is missing, so running it again is safe.society_<job> account and its current treasury balance moves into it. Nothing to do. If the console says an account "is in the database but esx_addonaccount has not loaded it", restart the server.server/framework/esx.lua is open (not escrowed). Change SocietyAccountName there.data/bosses.json as before.config/config.lua only documents the new treasury exports.Replace the whole resource, except your data files (see above). If you edited config/config.lua or server/framework/esx.lua, copy your changes onto the new files.
qs-job-management/fxmanifest.lua — the version number and the three new treasury exports.qs-job-management/config/config.lua — documents GetTreasuryMoney, AddTreasuryMoney and RemoveTreasuryMoney.qs-job-management/server/framework/esx.lua — creates and reads the society_<job> accounts.qs-job-management/server/treasury.lua — treasury on the society account, the new exports and webhook titles.qs-job-management/server/main.lua — server-side checks on job events, the license job limit, job slots and duty hours.qs-job-management/server/boss.lua — grade permissions and boss access.qs-job-management/server/boss_admin.lua — creating and deleting jobs and grades, firing, admin checks.qs-job-management/server/contracts.lua — contracts checked against their recipient, the max jobs limit and existing grades.qs-job-management/server/chat.lua — job chat limited to the job's employees.qs-job-management/server/salary.lua, server/hrlog.lua, server/jobstats.lua, server/jobpermissions.lua — follow grade permissions instead of boss only.qs-job-management/client/main.lua, client/boss.lua — real job names for jobs created in the panel.qs-job-management/client/boss_admin.lua — removed duplicate handlers.Several server events trusted the job and grade sent by the client. Players can no longer give themselves any job, remove jobs or edit badges.
Players can no longer sign or reject a contract sent to someone else, or read the chat of a job they don't work in.
With esx_addonaccount, the treasury now uses the society_<job> account. Invoices from billing scripts that pay into it, such as esx_billing and qs-billing, appear in the treasury with no setup. Without esx_addonaccount, and on QB, the balance stays in the JSON file as before.
Every job gets its society_<job> account on start and when it is created in the panel. Existing treasury balances move to that account on first start.
exports['qs-job-management']:GetTreasuryMoney(job), AddTreasuryMoney(job, amount, reason) and RemoveTreasuryMoney(job, amount, reason). They take no treasury cut and pay no player. RemoveTreasuryMoney returns false when the job can't cover the amount. See config/config.lua.
Money entering or leaving the society account from other resources, such as esx_society deposits, now counts in the treasury and is logged as "Society".
Treasury, treasury percent, announcements, ranks, reports and contracts only worked for the boss, even when a grade had the permission. They now follow the grade. Only the boss and admins can edit grade permissions.
Employees with a delegated permission can no longer fire the boss or change their grade.
A boss who was fired or left the job kept access to the treasury. They now lose boss access.
Jobs created in the panel now appear in the admin Jobs list, show their real name in the job menu, and work with chat, invites and announcements. The list now shows every job in your framework.
Deleting a job now removes it from everyone, online or offline. Deleting a grade moves its employees to grade 0.
Firing an employee now always works when they are offline, and only affects the right player.
Editing a grade now applies to online employees right away.
Creating an existing job could add duplicate grades. It is now refused.
Contracts now respect the max jobs limit and only offer grades that exist.
The job menu no longer hangs when a job's level/XP table does not exist.
Config.NoLicenseUserMaxJobs now works.
Players are no longer sent to unemployed by mistake when they reach their last free job slot.
FirePlayerFromJobOffline now only clears the player's job if it is the one they were fired from.
Duty hours now start counting at login and go to the right job when the player switches jobs.
Treasury Discord webhooks now show the correct title, and adding funds as an admin is logged too.