Program: 44767
Project: 44767
Buggy source:
/** 
 * @param req
 * @param penalty
 * @param type
 * @param reason
 * @param duration
 * @param durationType
 * @param redirect
 * @param player
 * @param server
 * @param currentPlayer
 * @return
 * @throws HttpError
 */
private String createPenalty(HttpServletRequest req,Penalty penalty,String type,String reason,String duration,String durationType,String redirect,Player player,Server server,Player currentPlayer) throws HttpError {
  penalty.setReason(reason);
  penalty.setPlayer(player.getKey());
  if (currentPlayer != null)   penalty.setAdmin(currentPlayer.getKey());
  if (type.equals("String_Node_Str")) {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermissions().get(RemotePermissions.ADD_NOTICE))) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    penalty.setType(Penalty.NOTICE);
    if ((server.getPermission() & RemotePermissions.ADD_NOTICE) == RemotePermissions.ADD_NOTICE) {
      penalty.setSynced(false);
      penalty.setActive(false);
      Flash.info(req,MessageResource.getMessage("String_Node_Str"));
    }
 else {
      penalty.setSynced(true);
      penalty.setActive(true);
      Flash.warn(req,MessageResource.getMessage("String_Node_Str"));
    }
  }
 else {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermissions().get(RemotePermissions.ADD_BAN))) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    Long dm=Functions.time2minutes(duration + durationType);
    if (dm.equals(0)) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      return redirect;
    }
    if ((server.getPermission() & RemotePermissions.ADD_BAN) == RemotePermissions.ADD_BAN) {
      penalty.setSynced(false);
      penalty.setActive(false);
      Flash.info(req,MessageResource.getMessage("String_Node_Str"));
    }
 else {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      return redirect;
    }
    penalty.setType(Penalty.BAN);
    penalty.setDuration(dm);
  }
  return null;
}

Fixed version (ground truth):
/** 
 * @param req
 * @param penalty
 * @param type
 * @param reason
 * @param duration
 * @param durationType
 * @param redirect
 * @param player
 * @param server
 * @param currentPlayer
 * @return
 * @throws HttpError
 */
private String createPenalty(HttpServletRequest req,Penalty penalty,String type,String reason,String duration,String durationType,String redirect,Player player,Server server,Player currentPlayer) throws HttpError {
  penalty.setReason(reason);
  penalty.setPlayer(player.getKey());
  if (currentPlayer != null)   penalty.setAdmin(currentPlayer.getKey());
  if (type.equals("String_Node_Str")) {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermission(RemotePermissions.ADD_NOTICE))) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    penalty.setType(Penalty.NOTICE);
    if ((server.getRemotePermission() & RemotePermissions.ADD_NOTICE) == RemotePermissions.ADD_NOTICE) {
      penalty.setSynced(false);
      penalty.setActive(false);
      Flash.info(req,MessageResource.getMessage("String_Node_Str"));
    }
 else {
      penalty.setSynced(true);
      penalty.setActive(true);
      Flash.warn(req,MessageResource.getMessage("String_Node_Str"));
    }
  }
 else {
    if (!UserServiceFactory.getUserService().hasPermission(server.getKey(),server.getPermission(RemotePermissions.ADD_BAN))) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      throw new HttpError(HttpServletResponse.SC_FORBIDDEN);
    }
    Long dm=Functions.time2minutes(duration + durationType);
    if (dm.equals(0)) {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      return redirect;
    }
    if ((server.getRemotePermission() & RemotePermissions.ADD_BAN) == RemotePermissions.ADD_BAN) {
      penalty.setSynced(false);
      penalty.setActive(false);
      Flash.info(req,MessageResource.getMessage("String_Node_Str"));
    }
 else {
      Flash.error(req,MessageResource.getMessage("String_Node_Str"));
      return redirect;
    }
    penalty.setType(Penalty.BAN);
    penalty.setDuration(dm);
  }
  return null;
}