Can't use "ok = 1" outside of a module call.

Only modules can have their return codes updated.  Sections can't.

src/main/modcall.c

@@ -180,6 +180,8 @@ const FR_NAME_NUMBER mod_rcode_table[] = {
 };
 
 
+static char const *group_name[];
+
 /*
  *	Compile action && rcode for later use.
  */
@@ -192,6 +194,12 @@ static int compile_action(modcallable *c, CONF_PAIR *cp)
 	value = cf_pair_value(cp);
 	if (!value) return 0;
 
+	if (c->type != MOD_SINGLE) {
+		ERROR("%s[%d] Invalid return code assigment inside of a %s section",
+		      cf_pair_filename(cp), cf_pair_lineno(cp), group_name[c->type]);
+		return 0;
+	}
+
 	if (!strcasecmp(value, "return"))
 		action = MOD_ACTION_RETURN;
 

src/tests/keywords/if-rcode-error

@@ -0,0 +1,11 @@
+# PRE: if
+#
+#  return code in an "if" section.
+#
+if (User-Name == "bob") {
+	update reply {
+		Filter-Id := "filter"
+	}
+
+	ok = reject	# ERROR
+}