Durexio’s Advanced Teleport Menu offers a /spawn menu with 12 configured destinations and a return-to-last-location entry. The creator’s current attachment is qb-teleport-1.1.zip, released with Discord logging in April 2025; its manifest still says version 1.0.0. The older ZIP previously linked here has no logging code.
Resolve framework and permission issues first
The default configuration selects qb-core and qb-menu. The current archive’s resource folder is qb-teleport-1.1, containing config.lua, client.lua, server.lua and fxmanifest.lua. It includes no dependency packages. Keep the startup name consistent with the actual resource folder and inspect the following issues before enabling it on a public server.
The ESX selector does not provide a complete ESX implementation. Client and server permission callbacks still use Framework.Functions APIs, player access expects QBCore PlayerData, and ESX menu/notification calls use a separate ESX global that this resource does not initialize. Merely changing Config.Framework and Config.MenuType is not a verified ESX installation procedure.
Config.RequirePermission is false by default. Enabling it adds a menu access check, but the client teleport handler does not repeat authorization or validate the destination against the configured list. Treat menu visibility as interface behavior, not a security boundary. The Steam allowlist also compares only identifier index 0 rather than selecting the steam: identifier by type.
Keep logging destinations private
The 1.1 package includes a Discord webhook URL in config.lua, which the manifest loads as a shared script. Do not run that supplied destination or put your own secret in a file sent to clients. Move logging configuration to the server before use and replace any exposed credential. The included endpoint was not called or tested during this review.
The server logging handler accepts client-supplied labels and coordinates without permission, type or rate checks. It therefore does not provide trustworthy evidence that an authorized teleport happened. Repair validation and authorization together with framework handling; no patched or security-tested replacement is offered here.
Both the historical ZIP and the current creator ZIP passed full integrity checks on 11 September 2026. All four Lua files in each were read and compared. These are concrete code findings, not a FiveM runtime test or a claim that every server configuration fails.
Open Durexio’s original release, current attachment and update note