fix and unit-test

src/test/app/LoanBroker_test.cpp

@@ -1189,6 +1189,19 @@ class LoanBroker_test : public beast::unit_test::suite
                 return mpt;
             },
             CoverClawback);
+
+        // MPTIssue:
+        // MPTCanClawback is set but MPTCanLock is not set
+        testLoanBroker(
+            [&](Env& env, Account const& issuer, Account const& alice) -> MPT {
+                MPTTester mpt{env, issuer, mptInitNoFund};
+                mpt.create({.flags = tfMPTCanClawback | tfMPTCanTransfer});
+                env.close();
+                mpt.authorize({.account = alice});
+                env.close();
+                return mpt;
+            },
+            CoverClawback);
     }
 
     void

src/xrpld/app/tx/detail/LoanBrokerCoverClawback.cpp

@@ -192,7 +192,8 @@ preclaimHelper<MPTIssue>(
     if (!sleIssuance)
         return tecOBJECT_NOT_FOUND;
 
-    if (!sleIssuance->isFlag(lsfMPTCanClawback))
+    if (!sleIssuance->isFlag(lsfMPTCanClawback) ||
+        !sleIssuance->isFlag(lsfMPTCanLock))
         return tecNO_PERMISSION;
 
     // With all the checking already done, this should be impossible