From: Paweł Chmielowski <pchmielowski@process-one.net>
Date: Wed, 30 Jan 2019 12:09:06 +0000 (+0100)
Subject: Require that both tag and module matched in from of api_permission
X-Git-Tag: 19.02~40
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=096b4a50e59522d1f324d8d5c870f27ddc4425f9;p=ejabberd

Require that both tag and module matched in from of api_permission
---

diff --git a/src/ejabberd_access_permissions.erl b/src/ejabberd_access_permissions.erl
index 368f07529..0c53795b8 100644
--- a/src/ejabberd_access_permissions.erl
+++ b/src/ejabberd_access_permissions.erl
@@ -265,7 +265,9 @@ get_definitions(#state{definitions = none, fragments_generators = Gens} = State)
 matches_definition({_Name, {From, Who, What}}, Cmd, Module, Tag, Host, CallerInfo) ->
     case What == all orelse lists:member(Cmd, What) of
 	true ->
-	    case From == [] orelse lists:member(Module, From) orelse lists:member({tag, Tag}, From) of
+	    {Tags, Modules} = lists:partition(fun({tag, _}) -> true; (_) -> false end, From),
+	    case (Modules == [] orelse lists:member(Module, Modules)) andalso
+		 (Tags == [] orelse lists:member({tag, Tag}, Tags)) of
 		true ->
 		    Scope = maps:get(oauth_scope, CallerInfo, none),
 		    lists:any(