fix: get_apiusers cache key missing orgid causing cross-org data leak

2026-05-30 11:01:05 +08:00 · 2026-05-30 11:01:05 +08:00 · 4360f34576
commit 4360f34576
parent d67cc0b0da
1 changed files with 1 additions and 1 deletions
--- a/uapi/apidata.py
+++ b/uapi/apidata.py
@ -81,7 +81,7 @@ class UAPIData:
 		return None

 	async def get_apiusers(self, appid, orgid=None):
-		key = appid
+		key = f'{appid}.{orgid}' if orgid else str(appid)
 		if _cache_enabled():
 			d = self.org_users.get(key)
 			if d: