Program: 3602
Project: 3602
Buggy source:
protected void doDSPost(Context c,HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException, SQLException, AuthorizeException {
  int groupID=UIUtil.getIntParameter(request,"String_Node_Str");
  Group group=null;
  if (groupID >= 0) {
    group=Group.find(c,groupID);
  }
  if (group != null) {
    AuthorizeManager.authorizeAction(c,group,Constants.ADD);
    String button=UIUtil.getSubmitButton(request,"String_Node_Str");
    if (button.equals("String_Node_Str")) {
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
    }
 else     if (button.equals("String_Node_Str")) {
      String newName=request.getParameter("String_Node_Str");
      if (!newName.equals(group.getName())) {
        group.setName(newName);
        group.update();
      }
      int[] eperson_ids=UIUtil.getIntParameters(request,"String_Node_Str");
      if (eperson_ids != null) {
        EPerson[] members=group.getMembers();
        for (int x=0; x < eperson_ids.length; x++) {
          int foundIndex=-1;
          for (int y=0; y < members.length; y++) {
            if ((members[y] != null) && (members[y].getID() == eperson_ids[x])) {
              foundIndex=y;
              break;
            }
          }
          if (foundIndex == -1) {
            EPerson e=EPerson.find(c,eperson_ids[x]);
            group.addMember(e);
          }
 else {
            members[foundIndex]=null;
          }
        }
        for (int y=0; y < members.length; y++) {
          if (members[y] != null) {
            group.removeMember(members[y]);
          }
        }
        group.update();
      }
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
      c.complete();
    }
 else     if (button.equals("String_Node_Str")) {
      AuthorizeManager.authorizeAction(c,group,Constants.WRITE);
      group.delete();
      showMainPage(c,request,response);
      c.complete();
    }
 else {
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
    }
  }
 else {
    String button=UIUtil.getSubmitButton(request,"String_Node_Str");
    if (button.equals("String_Node_Str")) {
      group=Group.create(c);
      group.setName("String_Node_Str" + group.getID());
      group.update();
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
      c.complete();
    }
 else {
      showMainPage(c,request,response);
    }
  }
}

Fixed version (ground truth):
protected void doDSPost(Context c,HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException, SQLException, AuthorizeException {
  int groupID=UIUtil.getIntParameter(request,"String_Node_Str");
  Group group=null;
  if (groupID >= 0) {
    group=Group.find(c,groupID);
  }
  if (group != null) {
    AuthorizeManager.authorizeAction(c,group,Constants.ADD);
    String button=UIUtil.getSubmitButton(request,"String_Node_Str");
    if (button.equals("String_Node_Str")) {
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
    }
 else     if (button.equals("String_Node_Str")) {
      String newName=request.getParameter("String_Node_Str");
      if (!newName.equals(group.getName())) {
        group.setName(newName);
        group.update();
      }
      int[] eperson_ids=UIUtil.getIntParameters(request,"String_Node_Str");
      EPerson[] members=group.getMembers();
      if (eperson_ids != null) {
        for (int x=0; x < eperson_ids.length; x++) {
          int foundIndex=-1;
          for (int y=0; y < members.length; y++) {
            if ((members[y] != null) && (members[y].getID() == eperson_ids[x])) {
              foundIndex=y;
              break;
            }
          }
          if (foundIndex == -1) {
            EPerson e=EPerson.find(c,eperson_ids[x]);
            group.addMember(e);
          }
 else {
            members[foundIndex]=null;
          }
        }
        for (int y=0; y < members.length; y++) {
          if (members[y] != null) {
            group.removeMember(members[y]);
          }
        }
      }
 else {
        for (int y=0; y < members.length; y++) {
          group.removeMember(members[y]);
        }
      }
      group.update();
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
      c.complete();
    }
 else     if (button.equals("String_Node_Str")) {
      AuthorizeManager.authorizeAction(c,group,Constants.WRITE);
      group.delete();
      showMainPage(c,request,response);
      c.complete();
    }
 else {
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
    }
  }
 else {
    String button=UIUtil.getSubmitButton(request,"String_Node_Str");
    if (button.equals("String_Node_Str")) {
      group=Group.create(c);
      group.setName("String_Node_Str" + group.getID());
      group.update();
      request.setAttribute("String_Node_Str",group);
      request.setAttribute("String_Node_Str",group.getMembers());
      JSPManager.showJSP(request,response,"String_Node_Str");
      c.complete();
    }
 else {
      showMainPage(c,request,response);
    }
  }
}