Require that both tag and module matched in from of api_permission

diff --git a/src/ejabberd_access_permissions.erl b/src/ejabberd_access_permissions.erl
index 368f0752978573baec70832f265972296d1cdfaa..0c53795b84af7c8d8aefc3fbe4c3fea024a303de 100644 (file)
--- a/src/ejabberd_access_permissions.erl
+++ b/src/ejabberd_access_permissions.erl
@@ -265,7 +265,9 @@ get_definitions(#state{definitions = none, fragments_generators = Gens} = State)
 matches_definition({_Name, {From, Who, What}}, Cmd, Module, Tag, Host, CallerInfo) ->
     case What == all orelse lists:member(Cmd, What) of
        true ->
-           case From == [] orelse lists:member(Module, From) orelse lists:member({tag, Tag}, From) of
+           {Tags, Modules} = lists:partition(fun({tag, _}) -> true; (_) -> false end, From),
+           case (Modules == [] orelse lists:member(Module, Modules)) andalso
+                (Tags == [] orelse lists:member({tag, Tag}, Tags)) of
                true ->
                    Scope = maps:get(oauth_scope, CallerInfo, none),
                    lists:any(