fix: close remaining Z39 slug isolation gaps

Bind preview rows and published API base paths to the active module slug so cloned or stale state cannot address another module. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-07 17:34:15 +08:00
parent 473113682f
commit 154f849f57
5 changed files with 13 additions and 11 deletions
--- a/web/dist/assets/index-D2ZGs_V_.js
+++ b/web/dist/assets/index-D2ZGs_V_.js
--- a/web/dist/index.html
+++ b/web/dist/index.html
@@ -7,7 +7,7 @@
    <link rel="preconnect" href="https://fonts.googleapis.com" />
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
    <link href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,600;9..144,700&family=Manrope:wght@400;500;600;700&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-Pe8anoMp.js"></script>
+    <script type="module" crossorigin src="/assets/index-D2ZGs_V_.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/index-CtqUfnO-.css">
  </head>
  <body>
--- a/web/src/api.ts
+++ b/web/src/api.ts
@@ -386,7 +386,12 @@ export async function listRows(
    : `${PLATFORM}/api/v1/public/apps/${slug}/${resource}?${qs}`;
  // 草稿预览：优先用预览包内嵌行数据（未发布也可出图）
  const prev = getActivePreview();
-  if (prev && (!resource || resource === prev.resource || !prev.resource)) {
+  const previewSlug = String(prev?.blueprint?.meta?.slug || "");
+  if (
+    prev &&
+    previewSlug === slug &&
+    (!resource || resource === prev.resource || !prev.resource)
+  ) {
    let items = prev.rows || [];
    if (filters) {
      items = items.filter((row) =>