mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-22 10:33:13 +00:00
app/admin/models/datascope.go carried a second copy of the scope logic with no callers. Its department-tree pattern was written as "%" + id + "%" instead of "%/" + id + "/%", so dept_id 1 also matched /11/, /21/ and /100/ - visibility into unrelated subtrees. It sat where someone looking for a data permission example would find it. The copy that is actually wired up stays in common/actions. Claude-Session: https://claude.ai/code/session_01HPTAw8b8tAdFNFn8rKdPYx