Program: 189304
Project: 189304
Buggy source:
/** 
 * Display the faculty advisor's review page where the user can approve or reject a submission. Theoretically we can identify the advisor based upon their use of the security token. If they have that token then they can access the submission. We still require that they authenticate first so we atleast have a user account associated with them.
 * @param token The advisor's sort-of-security token.
 */
@Security(RoleType.NONE) public static void review(String token){
  Person person=context.getPerson();
  if (context.isManager()) {
    String affiliationConfig=Play.configuration.getProperty(AFFILIATION_CONFIG,"String_Node_Str");
    if ("String_Node_Str".equals(affiliationConfig)) {
      for (      String affiliation : affiliationConfig.split("String_Node_Str")) {
        if (person.getAffiliations().contains(affiliation.trim())) {
          unauthorized("String_Node_Str" + affiliationConfig + "String_Node_Str");
        }
      }
    }
  }
  notFoundIfNull(token);
  Submission sub=subRepo.findSubmissionByEmailHash(token);
  notFoundIfNull(sub);
  Logger.info("String_Node_Str",person.getFormattedName(NameFormat.FIRST_LAST),person.getId(),person.getEmail(),sub.getId());
  String grantor=settingRepo.getConfigValue(AppConfig.GRANTOR,"String_Node_Str");
  List<EmbargoType> allEmbargos=settingRepo.findAllEmbargoTypes();
  Person submitter=sub.getSubmitter();
  List<ActionLog> logs=subRepo.findActionLog(sub);
  Attachment primaryDocument=sub.getPrimaryDocument();
  List<Attachment> additionalDocuments=sub.getAttachmentsByType(AttachmentType.SUPPLEMENTAL,AttachmentType.ADMINISTRATIVE,AttachmentType.SOURCE);
  List<Attachment> feedbackDocuments=sub.getAttachmentsByType(AttachmentType.FEEDBACK);
  for (  FieldConfig field : FieldConfig.values()) {
    renderArgs.put(field.name(),field);
  }
  renderTemplate("String_Node_Str",token,sub,submitter,logs,primaryDocument,additionalDocuments,feedbackDocuments,grantor,allEmbargos);
}

Fixed version (ground truth):
/** 
 * Display the faculty advisor's review page where the user can approve or reject a submission. Theoretically we can identify the advisor based upon their use of the security token. If they have that token then they can access the submission. We still require that they authenticate first so we atleast have a user account associated with them.
 * @param token The advisor's sort-of-security token.
 */
public static void review(String token){
  Person person=context.getPerson();
  if (context.isManager()) {
    String affiliationConfig=Play.configuration.getProperty(AFFILIATION_CONFIG,"String_Node_Str");
    if ("String_Node_Str".equals(affiliationConfig)) {
      for (      String affiliation : affiliationConfig.split("String_Node_Str")) {
        if (person.getAffiliations().contains(affiliation.trim())) {
          unauthorized("String_Node_Str" + affiliationConfig + "String_Node_Str");
        }
      }
    }
  }
  notFoundIfNull(token);
  Submission sub=subRepo.findSubmissionByEmailHash(token);
  notFoundIfNull(sub);
  if (person != null)   Logger.info("String_Node_Str",person.getFormattedName(NameFormat.FIRST_LAST),person.getId(),person.getEmail(),sub.getId());
  String grantor=settingRepo.getConfigValue(AppConfig.GRANTOR,"String_Node_Str");
  List<EmbargoType> allEmbargos=settingRepo.findAllEmbargoTypes();
  Person submitter=sub.getSubmitter();
  List<ActionLog> logs=subRepo.findActionLog(sub);
  Attachment primaryDocument=sub.getPrimaryDocument();
  List<Attachment> additionalDocuments=sub.getAttachmentsByType(AttachmentType.SUPPLEMENTAL,AttachmentType.ADMINISTRATIVE,AttachmentType.SOURCE);
  List<Attachment> feedbackDocuments=sub.getAttachmentsByType(AttachmentType.FEEDBACK);
  for (  FieldConfig field : FieldConfig.values()) {
    renderArgs.put(field.name(),field);
  }
  renderTemplate("String_Node_Str",token,sub,submitter,logs,primaryDocument,additionalDocuments,feedbackDocuments,grantor,allEmbargos);
}