Program: 44766
Project: 44766
Buggy source:
/** 
 * @param req
 * @param redirect
 * @param player
 * @param server
 * @param penalty
 * @return
 * @throws HttpError
 */
private String removePenalty(HttpServletRequest req,String redirect,Player player,Server server,Penalty penalty) throws HttpError {
  if (!penalty.getPlayer().equals(player.getKey())) {
    log.debug("String_Node_Str");
    Flash.error(req,MessageResource.getMessage("String_Node_Str"));
    throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
  }
  if (penalty.getType().equals(Penalty.BAN)) {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermissions().get(RemotePermissions.REMOVE_BAN))) {
      log.debug("String_Node_Str");
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    if (!((server.getPermission() & RemotePermissions.REMOVE_BAN) == RemotePermissions.REMOVE_BAN)) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      return redirect;
    }
    Flash.info(req,MessageResource.getMessage("String_Node_Str"));
    penalty.setSynced(false);
  }
 else {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermissions().get(RemotePermissions.REMOVE_NOTICE))) {
      log.debug("String_Node_Str");
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    if (!((server.getPermission() & RemotePermissions.REMOVE_NOTICE) == RemotePermissions.REMOVE_NOTICE)) {
      Flash.warn(req,MessageResource.getMessage("String_Node_Str"));
      penalty.setSynced(true);
      penalty.setActive(false);
    }
 else {
      Flash.info(req,MessageResource.getMessage("String_Node_Str"));
      penalty.setSynced(false);
    }
  }
  return null;
}

Fixed version (ground truth):
/** 
 * @param req
 * @param redirect
 * @param player
 * @param server
 * @param penalty
 * @return
 * @throws HttpError
 */
private String removePenalty(HttpServletRequest req,String redirect,Player player,Server server,Penalty penalty) throws HttpError {
  if (!penalty.getPlayer().equals(player.getKey())) {
    log.debug("String_Node_Str");
    Flash.error(req,MessageResource.getMessage("String_Node_Str"));
    throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
  }
  if (penalty.getType().equals(Penalty.BAN)) {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermission(RemotePermissions.REMOVE_BAN))) {
      log.debug("String_Node_Str");
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    if (!((server.getRemotePermission() & RemotePermissions.REMOVE_BAN) == RemotePermissions.REMOVE_BAN)) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      return redirect;
    }
    Flash.info(req,MessageResource.getMessage("String_Node_Str"));
    penalty.setSynced(false);
  }
 else {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermission(RemotePermissions.REMOVE_NOTICE))) {
      log.debug("String_Node_Str");
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    if (!((server.getRemotePermission() & RemotePermissions.REMOVE_NOTICE) == RemotePermissions.REMOVE_NOTICE)) {
      Flash.warn(req,MessageResource.getMessage("String_Node_Str"));
      penalty.setSynced(true);
      penalty.setActive(false);
    }
 else {
      Flash.info(req,MessageResource.getMessage("String_Node_Str"));
      penalty.setSynced(false);
    }
  }
  return null;
}