StateBag strict mode compatibility with pma-voice

[jxeqoz]

Hello,

I noticed a conflict between the recommendations from ox_lib and pma-voice regarding StateBag strict mode.

According to the ox_lib documentation/changelog, enabling:

setr sv_stateBagStrictMode true

is recommended for improved security and preventing clients from modifying state bags.

However, when using pma-voice with StateBag strict mode enabled, I receive warnings such as:

[natives] StateBags can't be modified from the client, because the StateBag strict mode is enabled.

As a result, some users suggest disabling strict mode:

setr sv_stateBagStrictMode false

Could you clarify the current recommendation for pma-voice?

• Is pma-voice fully compatible with sv_stateBagStrictMode true?
• Are these warnings expected and harmless?
• Is there a planned fix if pma-voice still performs client-side StateBag modifications?
• Should server owners prioritize ox_lib's recommendation and keep strict mode enabled?

Reference:
overextended/ox_lib@v3.37.0...main#diff-8dc1734e5f18700a7b95f67e02093f689b10b9433357b580f680ed5f9cab2a58

Thank you.

[AvarianKnight]

Some of this might be somewhat of a rant

Overall ox_lib is correct, pma-voice started using state bags before a Cfx element decided that allowing any client to write any state bag to the server was a great idea. Prior to some commits clients could freely modify only state bags that the server had created, you can see my rant about this here citizenfx/fivem#2362 (comment)

Generally keeping strict state bags enabled is preferred since Cfx has failed to actually give a way for a server to reject state bag changes, leading to the client being able to set state bags however they want, but this resource was made with the assumption that the client would be able to set its proximity state bag and its disableRadio state bag among others.

I don't see myself working on fixing this, though others are fine to make PR's for this.