g-employee-chatandlist by GrootDevelopment provides a job employee list and chat interface. The reviewed manifest declares version 1.0.0 and includes ESX, QBCore and Qbox bridges.
Installation and configured jobs
Keep the resource folder g-employee-chatandlist with bridge, src, locales and web/build intact. Start your chosen framework and oxmysql before ensure g-employee-chatandlist. The shipped manifest also loads @ox_lib/init.lua; keep ox_lib available unless deliberately adapting the manifest for a supported configuration. The Qbox client checks qbx_core version 1.19.0.
Edit src/shared/Config.lua. The defaults enable the system and chat, allow police and ambulance, and register /emenu. The database adapters read existing framework tables: users and job_grades for ESX, or players for QBCore/Qbox. No separate SQL installer is included; verify your schema instead of importing an invented chat table.
Employee counts are framework-specific
The QBCore adapter reports the online total as either zero or one, even when several employees are connected. The Qbox adapter uses GetDutyCountJob, which represents a duty count rather than the same connected-player count used by ESX. The ESX grade-label lookup filters by grade alone, without the job name. Correct these distinctions before presenting the display as an accurate live roster.
The creator README warns that changing jobs in-game may require restarting the game. Job-update handlers exist, but they do not establish successful integration with every framework version. Test multiple online employees, offline records, same-number grades in different jobs, job changes and resource restarts.
Server access and message checks
The roster request accepts a client-supplied job and does not first verify that the requester belongs to that job or Config.Jobs. QBCore and Qbox also concatenate that value into a database query. Derive the allowed job on the server and use parameterized queries before exposing the resource to players.
Chat recipients are selected using the sender’s server-side job, but sender labels and message contents come from the client. The handler does not enforce the configured job allowlist, message length or a rate limit. Add those checks and derive the displayed sender name server-side; a client menu restriction alone does not authorize server requests.
Existing creator preview
Source checked on 10 September 2026 at revision dbf73cb23ba0dd83fad608641c0da0be9a9928d3. Manifest, configuration, framework bridges and chat/list handlers were inspected. No framework database, chat session or multiplayer test was run; the preserved video is not proof that the listed defects are fixed.