Commit Graph

1 Commits

Author SHA1 Message Date
Misaka_Company
6ecf03ce11 fix: scope User operations to visible data only in CleanerPage
Fix critical bug where non-Admin users could affect other users' data
when using "取消" (Uncheck All) and "确认删除" (Confirm Deletion) buttons.

Problem:
- User users see only their filtered materials in table (filteredResults)
- "取消" button was unchecking ALL materials in validationResults
- "确认删除" was processing ALL materials, not just visible ones
- This caused User A to delete/modify User B's invisible data

Solution:
1. Modified "取消" button to only uncheck visible filteredResults
   - Now removes selectedItems only for visible material codes
   - Preserves selections for other users' invisible data

2. Modified handleConfirmDeletion to process only visible items for non-Admin users
   - Admin: processes all validationResults (unchanged behavior)
   - User: processes only filteredResults (scoped to their data)

Security Impact:
- Prevents cross-user data interference
- Ensures User scope isolation
- Maintains Admin full access to all data

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-03-03 11:13:39 +08:00