Program: 3600
Project: 3600
Buggy source:
/** 
 * Process input from one of the permissions pages
 * @param context     DSpace context
 * @param request     HTTP request
 * @param response    HTTP response
 * @param collection  Collection we're editing
 */
private void processPermissions(Context context,HttpServletRequest request,HttpServletResponse response,Collection collection) throws SQLException, ServletException, IOException, AuthorizeException {
  int permission=UIUtil.getIntParameter(request,"String_Node_Str");
  if (UIUtil.getBoolParameter(request,"String_Node_Str")) {
    Group mitGroup=Group.findByName(context,"String_Node_Str");
    int action;
    if (permission == PERM_READ) {
      AuthorizeManager.addPolicy(context,collection,Constants.READ,mitGroup);
    }
 else {
      AuthorizeManager.addPolicy(context,collection,Constants.ADD,mitGroup);
    }
  }
  Group g=null;
switch (permission) {
case PERM_READ:
    g=Group.create(context);
  g.setName("String_Node_Str" + collection.getID() + "String_Node_Str");
AuthorizeManager.addPolicy(context,collection,Constants.READ,g);
break;
case PERM_SUBMIT:
g=collection.getSubmitters();
break;
case PERM_WF1:
g=collection.getWorkflowGroup(1);
break;
case PERM_WF2:
g=collection.getWorkflowGroup(2);
break;
case PERM_WF3:
g=collection.getWorkflowGroup(3);
break;
case PERM_EDITOR:
g=collection.getEditors();
break;
}
int[] ids=UIUtil.getIntParameters(request,"String_Node_Str");
if (ids != null) {
for (int i=0; i < ids.length; i++) {
EPerson eperson=EPerson.find(context,ids[i]);
if (eperson != null) {
g.addMember(eperson);
}
}
}
g.update();
showNextPage(context,request,response,collection,permission);
context.complete();
}

Fixed version (ground truth):
/** 
 * Process input from one of the permissions pages
 * @param context     DSpace context
 * @param request     HTTP request
 * @param response    HTTP response
 * @param collection  Collection we're editing
 */
private void processPermissions(Context context,HttpServletRequest request,HttpServletResponse response,Collection collection) throws SQLException, ServletException, IOException, AuthorizeException {
  int permission=UIUtil.getIntParameter(request,"String_Node_Str");
  if (UIUtil.getBoolParameter(request,"String_Node_Str")) {
    Group mitGroup=Group.findByName(context,"String_Node_Str");
    int action;
    if (permission == PERM_READ) {
      AuthorizeManager.addPolicy(context,collection,Constants.DEFAULT_ITEM_READ,mitGroup);
      AuthorizeManager.addPolicy(context,collection,Constants.DEFAULT_BITSTREAM_READ,mitGroup);
    }
 else {
      AuthorizeManager.addPolicy(context,collection,Constants.ADD,mitGroup);
    }
  }
  Group g=null;
switch (permission) {
case PERM_READ:
    g=Group.create(context);
  g.setName("String_Node_Str" + collection.getID() + "String_Node_Str");
AuthorizeManager.addPolicy(context,collection,Constants.DEFAULT_ITEM_READ,g);
AuthorizeManager.addPolicy(context,collection,Constants.DEFAULT_BITSTREAM_READ,g);
break;
case PERM_SUBMIT:
g=collection.getSubmitters();
break;
case PERM_WF1:
g=collection.getWorkflowGroup(1);
break;
case PERM_WF2:
g=collection.getWorkflowGroup(2);
break;
case PERM_WF3:
g=collection.getWorkflowGroup(3);
break;
case PERM_EDITOR:
g=collection.getEditors();
break;
}
int[] ids=UIUtil.getIntParameters(request,"String_Node_Str");
if (ids != null) {
for (int i=0; i < ids.length; i++) {
EPerson eperson=EPerson.find(context,ids[i]);
if (eperson != null) {
g.addMember(eperson);
}
}
}
g.update();
showNextPage(context,request,response,collection,permission);
context.complete();
}