Source:
<code>public Response enrollToExam(fi.otavanopisto.pyramus.rest.model.MatriculationExamEnrollment enrollment) { <START> Student student = studentDao.findById(enrollment.getStudentId()); <END> if (student == null) { return Response.status(Status.BAD_REQUEST).entity("Student not found").build(); } if (!"PENDING".equals(enrollment.getState())) { return Response.status(Status.FORBIDDEN) .entity("Can only send pending enrollments via REST") .build(); } try { MatriculationExamEnrollment enrollmentEntity = matriculationExamEnrollmentDao.create( enrollment.getName(), enrollment.getSsn(), enrollment.getEmail(), enrollment.getPhone(), enrollment.getAddress(), enrollment.getPostalCode(), enrollment.getCity(), enrollment.getNationalStudentNumber(), enrollment.getGuider(), SchoolType.valueOf(enrollment.getEnrollAs()), enrollment.getNumMandatoryCourses(), enrollment.isRestartExam(), enrollment.getLocation(), enrollment.getMessage(), enrollment.isCanPublishName(), student, MatriculationExamEnrollmentState.valueOf(enrollment.getState())); for (MatriculationExamAttendance attendance : enrollment.getAttendances()) { matriculationExamAttendanceDao.create( enrollmentEntity, MatriculationExamSubject.valueOf(attendance.getSubject()), attendance.getMandatory(), attendance.getRepeat(), attendance.getYear(), attendance.getTerm() != null ? MatriculationExamTerm.valueOf(attendance.getTerm()) : null, attendance.getStatus() != null ? MatriculationExamAttendanceStatus.valueOf(attendance.getStatus()) : null, attendance.getGrade() != null ? MatriculationExamGrade.valueOf(attendance.getGrade()) : null); } } catch (IllegalArgumentException ex) { return Response.status(Status.BAD_REQUEST) .entity(ex.getMessage()) .build(); } return Response.ok().build(); }</code><technical_language>Check student enroll him/herself, other students. Easiest remove student permission check permission for admins logged user for students</technical_language>

Target:
public Response enrollToExam(fi.otavanopisto.pyramus.rest.model.MatriculationExamEnrollment enrollment) { Student student = studentDao.findById(enrollment.getStudentId()); if (student == null) { return Response.status(Status.BAD_REQUEST).entity("Student not found").build(); } if (!restSecurity.hasPermission(new String[] { UserPermissions.USER_OWNER }, student)) { return Response.status(Status.FORBIDDEN).build(); } if (!"PENDING".equals(enrollment.getState())) { return Response.status(Status.FORBIDDEN) .entity("Can only send pending enrollments via REST") .build(); } try { MatriculationExamEnrollment enrollmentEntity = matriculationExamEnrollmentDao.create( enrollment.getName(), enrollment.getSsn(), enrollment.getEmail(), enrollment.getPhone(), enrollment.getAddress(), enrollment.getPostalCode(), enrollment.getCity(), enrollment.getNationalStudentNumber(), enrollment.getGuider(), SchoolType.valueOf(enrollment.getEnrollAs()), enrollment.getNumMandatoryCourses(), enrollment.isRestartExam(), enrollment.getLocation(), enrollment.getMessage(), enrollment.isCanPublishName(), student, MatriculationExamEnrollmentState.valueOf(enrollment.getState())); for (MatriculationExamAttendance attendance : enrollment.getAttendances()) { matriculationExamAttendanceDao.create( enrollmentEntity, MatriculationExamSubject.valueOf(attendance.getSubject()), attendance.getMandatory(), attendance.getRepeat(), attendance.getYear(), attendance.getTerm() != null ? MatriculationExamTerm.valueOf(attendance.getTerm()) : null, attendance.getStatus() != null ? MatriculationExamAttendanceStatus.valueOf(attendance.getStatus()) : null, attendance.getGrade() != null ? MatriculationExamGrade.valueOf(attendance.getGrade()) : null); } } catch (IllegalArgumentException ex) { return Response.status(Status.BAD_REQUEST) .entity(ex.getMessage()) .build(); } return Response.ok(enrollment).build(); }