Program: 3650
Project: 3650
Buggy source:
/** 
 * Process information from "Personal information page"
 * @param context   current DSpace context
 * @param request   current servlet request object
 * @param response  current servlet response object
 */
private void processPersonalInfo(Context context,HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException, SQLException, AuthorizeException {
  String token=request.getParameter("String_Node_Str");
  String email=AccountManager.getEmail(context,token);
  if (email == null) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + token));
    JSPManager.showJSP(request,response,"String_Node_Str");
    return;
  }
  EPerson eperson=EPerson.findByEmail(context,email);
  if (eperson == null) {
    context.setIgnoreAuthorization(true);
    eperson=EPerson.create(context);
    eperson.setEmail(email);
    eperson.update();
    context.setIgnoreAuthorization(false);
  }
  context.setCurrentUser(eperson);
  boolean infoOK=EditProfileServlet.updateUserProfile(eperson,request);
  eperson.setCanLogIn(true);
  eperson.setSelfRegistered(true);
  Authenticate.getSiteAuth().initEPerson(context,request,eperson);
  boolean passwordOK=true;
  if (eperson.getRequireCertificate() == false && Authenticate.getSiteAuth().allowSetPassword(context,request,eperson.getEmail())) {
    passwordOK=EditProfileServlet.confirmAndSetPassword(eperson,request);
  }
  if (infoOK && passwordOK) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + eperson.getEmail()));
    AccountManager.deleteToken(context,token);
    eperson.update();
    request.setAttribute("String_Node_Str",eperson);
    JSPManager.showJSP(request,response,"String_Node_Str");
    context.complete();
  }
 else {
    request.setAttribute("String_Node_Str",token);
    request.setAttribute("String_Node_Str",eperson);
    request.setAttribute("String_Node_Str",new Boolean(!infoOK));
    request.setAttribute("String_Node_Str",new Boolean(!infoOK));
    boolean setPassword=Authenticate.getSiteAuth().allowSetPassword(context,request,email);
    request.setAttribute("String_Node_Str",new Boolean(setPassword));
    JSPManager.showJSP(request,response,"String_Node_Str");
    context.abort();
  }
}

Fixed version (ground truth):
/** 
 * Process information from "Personal information page"
 * @param context   current DSpace context
 * @param request   current servlet request object
 * @param response  current servlet response object
 */
private void processPersonalInfo(Context context,HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException, SQLException, AuthorizeException {
  String token=request.getParameter("String_Node_Str");
  String email=AccountManager.getEmail(context,token);
  if (email == null) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + token));
    JSPManager.showJSP(request,response,"String_Node_Str");
    return;
  }
  EPerson eperson=EPerson.findByEmail(context,email);
  if (eperson == null) {
    context.setIgnoreAuthorization(true);
    eperson=EPerson.create(context);
    eperson.setEmail(email);
    eperson.update();
    context.setIgnoreAuthorization(false);
  }
  context.setCurrentUser(eperson);
  boolean infoOK=EditProfileServlet.updateUserProfile(eperson,request);
  eperson.setCanLogIn(true);
  eperson.setSelfRegistered(true);
  Authenticate.getSiteAuth().initEPerson(context,request,eperson);
  boolean passwordOK=true;
  if (eperson.getRequireCertificate() == false && Authenticate.getSiteAuth().allowSetPassword(context,request,eperson.getEmail())) {
    passwordOK=EditProfileServlet.confirmAndSetPassword(eperson,request);
  }
  if (infoOK && passwordOK) {
    log.info(LogManager.getHeader(context,"String_Node_Str","String_Node_Str" + eperson.getEmail()));
    AccountManager.deleteToken(context,token);
    eperson.update();
    request.setAttribute("String_Node_Str",eperson);
    JSPManager.showJSP(request,response,"String_Node_Str");
    context.complete();
  }
 else {
    request.setAttribute("String_Node_Str",token);
    request.setAttribute("String_Node_Str",eperson);
    request.setAttribute("String_Node_Str",new Boolean(!infoOK));
    request.setAttribute("String_Node_Str",new Boolean(!passwordOK));
    boolean setPassword=Authenticate.getSiteAuth().allowSetPassword(context,request,email);
    request.setAttribute("String_Node_Str",new Boolean(setPassword));
    JSPManager.showJSP(request,response,"String_Node_Str");
    context.abort();
  }
}