From a36b117c45f1f86b9cfe0d8f005f780b03eea7eb Mon Sep 17 00:00:00 2001 From: Zero King Date: Sun, 17 May 2026 11:59:41 +0800 Subject: [PATCH 1/2] Sort sources correctly so that 'all' comes last sort_sources/1 is supposed to put 'all' matches at the end of the list. Therefore, the ordering function should return false for {all, _}, given the rule that Fun(A, B) is to return true only if A compares less than or equal to B in the ordering. Signed-off-by: Zero King --- src/riak_core_security.erl | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/riak_core_security.erl b/src/riak_core_security.erl index 610669e9..98e1dcfd 100644 --- a/src/riak_core_security.erl +++ b/src/riak_core_security.erl @@ -1085,15 +1085,15 @@ match_source([{UserName, {IP,Mask}, Source, Options}|Tail], User, PeerIP) -> sort_sources(Sources) -> %% sort sources first by userlist, so that 'all' matches come last - %% and then by CIDR, so that most sprcific masks come first + %% and then by CIDR, so that most specific masks come first Sources1 = lists:sort(fun({UserA, _, _, _}, {UserB, _, _, _}) -> case {UserA, UserB} of {all, all} -> true; - {all, _} -> - %% anything is greater than 'all' - true; {_, all} -> + %% anything should come before 'all' + true; + {all, _} -> false; {_, _} -> true From 8b4ba8f882d64c3825d78d262956260b7120e1f1 Mon Sep 17 00:00:00 2001 From: Zero King Date: Fri, 22 May 2026 20:43:54 +0800 Subject: [PATCH 2/2] Sort user groups correctly so that 'all' comes last group_sources/1 is supposed to put 'all' matches at the end of the list. Signed-off-by: Zero King --- src/riak_core_security.erl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/riak_core_security.erl b/src/riak_core_security.erl index 98e1dcfd..2d23b285 100644 --- a/src/riak_core_security.erl +++ b/src/riak_core_security.erl @@ -1129,10 +1129,10 @@ group_sources(Sources) -> case {UserA, UserB} of {[all], [all]} -> true; - {[all], _} -> - %% anything is greater than 'all' - true; {_, [all]} -> + %% anything should come before 'all' + true; + {[all], _} -> false; {_, _} -> true