Program: 189414
Project: 189414
Buggy source:
/** 
 * This method is run before every action in any controller (with the
 * @With() annotation !). This method checks to see if someone has been previously authenticated and if so logs them in to the current security context. When someone is logged in their unique person id will be stored on the session as "personId". So this method simply checks that parameter and looks the user in the corresponding repository. In addition if the action is annotated with a @Security() annotation then this method will perform those minimal security checks. So if the annotation says that to access the action all users must be at least a REVIEWER then this method will check that. There are two resulting conditions, either there is no currently authenticated user or they do not meet the required access level. In the first case the user would be sent off to login, remembering where to go after completing authentication. For the other case where they are already logged in but don't meet the conditions then they will receive an unauthorized message.
 */
@Before(unless={"String_Node_Str","String_Node_Str","String_Node_Str"}) public static void securityCheck(){
  context.logout();
  Long personId=null;
  try {
    personId=Long.valueOf(session.get("String_Node_Str"));
  }
 catch (  RuntimeException re) {
  }
  Person person=null;
  if (personId != null) {
    person=personRepo.findPerson(personId);
    context.login(person);
  }
  Security security=getActionAnnotation(Security.class);
  if (security == null)   security=getControllerInheritedAnnotation(Security.class);
  if (security != null) {
    if (person == null) {
      flash.put("String_Node_Str","String_Node_Str".equals(request.method) ? request.url : null);
      loginList();
    }
    RoleType expectedRole=security.value();
    RoleType actualRole=person.getRole();
    if (expectedRole.ordinal() > actualRole.ordinal())     forbidden();
  }
}

Fixed version (ground truth):
/** 
 * This method is run before every action in any controller (with the
 * @With() annotation !). This method checks to see if someone has been previously authenticated and if so logs them in to the current security context. When someone is logged in their unique person id will be stored on the session as "personId". So this method simply checks that parameter and looks the user in the corresponding repository. In addition if the action is annotated with a @Security() annotation then this method will perform those minimal security checks. So if the annotation says that to access the action all users must be at least a REVIEWER then this method will check that. There are two resulting conditions, either there is no currently authenticated user or they do not meet the required access level. In the first case the user would be sent off to login, remembering where to go after completing authentication. For the other case where they are already logged in but don't meet the conditions then they will receive an unauthorized message.
 */
@Before(unless={"String_Node_Str","String_Node_Str","String_Node_Str"}) public static void securityCheck(){
  context.logout();
  Long personId=null;
  try {
    personId=Long.valueOf(session.get("String_Node_Str"));
  }
 catch (  RuntimeException re) {
  }
  Person person=null;
  if (personId != null) {
    person=personRepo.findPerson(personId);
    context.login(person);
  }
  Security security=getActionAnnotation(Security.class);
  if (security == null)   security=getControllerInheritedAnnotation(Security.class);
  if (security != null) {
    if (person == null) {
      flash.put("String_Node_Str",request.url);
      loginList();
    }
    RoleType expectedRole=security.value();
    RoleType actualRole=person.getRole();
    if (expectedRole.ordinal() > actualRole.ordinal())     forbidden();
  }
}