Program: 105936
Project: 105936
Buggy source:
@DB @Override public boolean updateTemplateOrIsoPermissions(BaseUpdateTemplateOrIsoPermissionsCmd cmd){
  final Long id=cmd.getId();
  final Account caller=CallContext.current().getCallingAccount();
  List<String> accountNames=cmd.getAccountNames();
  List<Long> projectIds=cmd.getProjectIds();
  Boolean isFeatured=cmd.isFeatured();
  Boolean isPublic=cmd.isPublic();
  Boolean isExtractable=cmd.isExtractable();
  String operation=cmd.getOperation();
  String mediaType="String_Node_Str";
  VMTemplateVO template=_tmpltDao.findById(id);
  if (template == null) {
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str"+ id);
  }
  if (cmd instanceof UpdateTemplatePermissionsCmd) {
    mediaType="String_Node_Str";
    if (template.getFormat().equals(ImageFormat.ISO)) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
  }
  if (cmd instanceof UpdateIsoPermissionsCmd) {
    mediaType="String_Node_Str";
    if (!template.getFormat().equals(ImageFormat.ISO)) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
  }
  if (projectIds != null) {
    if (accountNames == null) {
      accountNames=new ArrayList<String>();
    }
    for (    Long projectId : projectIds) {
      Project project=_projectMgr.getProject(projectId);
      if (project == null) {
        throw new InvalidParameterValueException("String_Node_Str" + projectId);
      }
      if (!_projectMgr.canAccessProjectAccount(caller,project.getProjectAccountId())) {
        throw new InvalidParameterValueException("String_Node_Str" + caller + "String_Node_Str"+ projectId);
      }
      accountNames.add(_accountMgr.getAccount(project.getProjectAccountId()).getAccountName());
    }
  }
  _accountMgr.checkAccess(caller,AccessType.ModifyEntry,true,template);
  if (template.getRemoved() != null) {
    s_logger.error("String_Node_Str" + mediaType + "String_Node_Str"+ id+ "String_Node_Str");
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str"+ id+ "String_Node_Str");
  }
  if (id.equals(Long.valueOf(1))) {
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str"+ id);
  }
  boolean isAdmin=_accountMgr.isAdmin(caller.getType());
  boolean allowPublicUserTemplates=AllowPublicUserTemplates.valueIn(template.getAccountId());
  if (!isAdmin && !allowPublicUserTemplates && isPublic != null && isPublic) {
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str");
  }
  if (accountNames != null) {
    if ((operation == null) || (!operation.equalsIgnoreCase("String_Node_Str") && !operation.equalsIgnoreCase("String_Node_Str") && !operation.equalsIgnoreCase("String_Node_Str"))) {
      throw new InvalidParameterValueException("String_Node_Str" + "String_Node_Str" + operation + "String_Node_Str");
    }
  }
  Long ownerId=template.getAccountId();
  if (ownerId == null) {
    throw new InvalidParameterValueException("String_Node_Str" + template.getName());
  }
  VMTemplateVO updatedTemplate=_tmpltDao.createForUpdate();
  if (isPublic != null) {
    updatedTemplate.setPublicTemplate(isPublic.booleanValue());
  }
  if (isFeatured != null) {
    updatedTemplate.setFeatured(isFeatured.booleanValue());
  }
  if (isExtractable != null) {
    if (!template.getFormat().equals(ImageFormat.ISO) && _accountMgr.isRootAdmin(caller.getId())) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
 else {
      updatedTemplate.setExtractable(isExtractable.booleanValue());
    }
  }
  _tmpltDao.update(template.getId(),updatedTemplate);
  if (("String_Node_Str".equalsIgnoreCase(operation) || "String_Node_Str".equalsIgnoreCase(operation)) && accountNames == null) {
    throw new InvalidParameterValueException("String_Node_Str" + operation + "String_Node_Str");
  }
  Account owner=_accountMgr.getAccount(ownerId);
  final Domain domain=_domainDao.findById(owner.getDomainId());
  if ("String_Node_Str".equalsIgnoreCase(operation)) {
    final List<String> accountNamesFinal=accountNames;
    final List<Long> accountIds=new ArrayList<Long>();
    Transaction.execute(new TransactionCallbackNoReturn(){
      @Override public void doInTransactionWithoutResult(      TransactionStatus status){
        for (        String accountName : accountNamesFinal) {
          Account permittedAccount=_accountDao.findActiveAccount(accountName,domain.getId());
          if (permittedAccount != null) {
            if (permittedAccount.getId() == caller.getId()) {
              continue;
            }
            accountIds.add(permittedAccount.getId());
            LaunchPermissionVO existingPermission=_launchPermissionDao.findByTemplateAndAccount(id,permittedAccount.getId());
            if (existingPermission == null) {
              LaunchPermissionVO launchPermission=new LaunchPermissionVO(id,permittedAccount.getId());
              _launchPermissionDao.persist(launchPermission);
            }
          }
 else {
            throw new InvalidParameterValueException("String_Node_Str" + accountName + "String_Node_Str"+ domain.getUuid()+ "String_Node_Str"+ "String_Node_Str");
          }
        }
      }
    }
);
    Map<String,Object> permit=new HashMap<String,Object>();
    permit.put(ApiConstants.ENTITY_TYPE,AclEntityType.VirtualMachineTemplate.toString());
    permit.put(ApiConstants.ENTITY_ID,id);
    permit.put(ApiConstants.ACCESS_TYPE,AccessType.UseEntry);
    permit.put(ApiConstants.ACL_ACTION,"String_Node_Str");
    permit.put(ApiConstants.ACCOUNTS,accountIds);
    _messageBus.publish(_name,EntityManager.MESSAGE_GRANT_ENTITY_EVENT,PublishScope.LOCAL,permit);
  }
 else   if ("String_Node_Str".equalsIgnoreCase(operation)) {
    List<Long> accountIds=new ArrayList<Long>();
    for (    String accountName : accountNames) {
      Account permittedAccount=_accountDao.findActiveAccount(accountName,domain.getId());
      if (permittedAccount != null) {
        accountIds.add(permittedAccount.getId());
      }
    }
    _launchPermissionDao.removePermissions(id,accountIds);
    Map<String,Object> permit=new HashMap<String,Object>();
    permit.put(ApiConstants.ENTITY_TYPE,AclEntityType.VirtualMachineTemplate.toString());
    permit.put(ApiConstants.ENTITY_ID,id);
    permit.put(ApiConstants.ACCESS_TYPE,AccessType.UseEntry);
    permit.put(ApiConstants.ACL_ACTION,"String_Node_Str");
    permit.put(ApiConstants.ACCOUNTS,accountIds);
    _messageBus.publish(_name,EntityManager.MESSAGE_REVOKE_ENTITY_EVENT,PublishScope.LOCAL,permit);
  }
 else   if ("String_Node_Str".equalsIgnoreCase(operation)) {
    updatedTemplate=_tmpltDao.createForUpdate();
    updatedTemplate.setPublicTemplate(false);
    updatedTemplate.setFeatured(false);
    _tmpltDao.update(template.getId(),updatedTemplate);
    _launchPermissionDao.removeAllPermissions(id);
    _messageBus.publish(_name,TemplateManager.MESSAGE_RESET_TEMPLATE_PERMISSION_EVENT,PublishScope.LOCAL,template.getId());
  }
  return true;
}

Fixed version (ground truth):
@DB @Override public boolean updateTemplateOrIsoPermissions(BaseUpdateTemplateOrIsoPermissionsCmd cmd){
  final Long id=cmd.getId();
  final Account caller=CallContext.current().getCallingAccount();
  List<String> accountNames=cmd.getAccountNames();
  List<Long> projectIds=cmd.getProjectIds();
  Boolean isFeatured=cmd.isFeatured();
  Boolean isPublic=cmd.isPublic();
  Boolean isExtractable=cmd.isExtractable();
  String operation=cmd.getOperation();
  String mediaType="String_Node_Str";
  VMTemplateVO template=_tmpltDao.findById(id);
  if (template == null) {
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str"+ id);
  }
  if (cmd instanceof UpdateTemplatePermissionsCmd) {
    mediaType="String_Node_Str";
    if (template.getFormat().equals(ImageFormat.ISO)) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
  }
  if (cmd instanceof UpdateIsoPermissionsCmd) {
    mediaType="String_Node_Str";
    if (!template.getFormat().equals(ImageFormat.ISO)) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
  }
  if (projectIds != null) {
    if (accountNames == null) {
      accountNames=new ArrayList<String>();
    }
    for (    Long projectId : projectIds) {
      Project project=_projectMgr.getProject(projectId);
      if (project == null) {
        throw new InvalidParameterValueException("String_Node_Str" + projectId);
      }
      if (!_projectMgr.canAccessProjectAccount(caller,project.getProjectAccountId())) {
        throw new InvalidParameterValueException("String_Node_Str" + caller + "String_Node_Str"+ projectId);
      }
      accountNames.add(_accountMgr.getAccount(project.getProjectAccountId()).getAccountName());
    }
  }
  _accountMgr.checkAccess(caller,AccessType.OperateEntry,true,template);
  if (template.getRemoved() != null) {
    s_logger.error("String_Node_Str" + mediaType + "String_Node_Str"+ id+ "String_Node_Str");
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str"+ id+ "String_Node_Str");
  }
  if (id.equals(Long.valueOf(1))) {
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str"+ id);
  }
  boolean isAdmin=_accountMgr.isAdmin(caller.getType());
  boolean allowPublicUserTemplates=AllowPublicUserTemplates.valueIn(template.getAccountId());
  if (!isAdmin && !allowPublicUserTemplates && isPublic != null && isPublic) {
    throw new InvalidParameterValueException("String_Node_Str" + mediaType + "String_Node_Str");
  }
  if (accountNames != null) {
    if ((operation == null) || (!operation.equalsIgnoreCase("String_Node_Str") && !operation.equalsIgnoreCase("String_Node_Str") && !operation.equalsIgnoreCase("String_Node_Str"))) {
      throw new InvalidParameterValueException("String_Node_Str" + "String_Node_Str" + operation + "String_Node_Str");
    }
  }
  Long ownerId=template.getAccountId();
  if (ownerId == null) {
    throw new InvalidParameterValueException("String_Node_Str" + template.getName());
  }
  VMTemplateVO updatedTemplate=_tmpltDao.createForUpdate();
  if (isPublic != null) {
    updatedTemplate.setPublicTemplate(isPublic.booleanValue());
  }
  if (isFeatured != null) {
    updatedTemplate.setFeatured(isFeatured.booleanValue());
  }
  if (isExtractable != null) {
    if (!template.getFormat().equals(ImageFormat.ISO) && _accountMgr.isRootAdmin(caller.getId())) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
 else {
      updatedTemplate.setExtractable(isExtractable.booleanValue());
    }
  }
  _tmpltDao.update(template.getId(),updatedTemplate);
  if (("String_Node_Str".equalsIgnoreCase(operation) || "String_Node_Str".equalsIgnoreCase(operation)) && accountNames == null) {
    throw new InvalidParameterValueException("String_Node_Str" + operation + "String_Node_Str");
  }
  Account owner=_accountMgr.getAccount(ownerId);
  final Domain domain=_domainDao.findById(owner.getDomainId());
  if ("String_Node_Str".equalsIgnoreCase(operation)) {
    final List<String> accountNamesFinal=accountNames;
    final List<Long> accountIds=new ArrayList<Long>();
    Transaction.execute(new TransactionCallbackNoReturn(){
      @Override public void doInTransactionWithoutResult(      TransactionStatus status){
        for (        String accountName : accountNamesFinal) {
          Account permittedAccount=_accountDao.findActiveAccount(accountName,domain.getId());
          if (permittedAccount != null) {
            if (permittedAccount.getId() == caller.getId()) {
              continue;
            }
            accountIds.add(permittedAccount.getId());
            LaunchPermissionVO existingPermission=_launchPermissionDao.findByTemplateAndAccount(id,permittedAccount.getId());
            if (existingPermission == null) {
              LaunchPermissionVO launchPermission=new LaunchPermissionVO(id,permittedAccount.getId());
              _launchPermissionDao.persist(launchPermission);
            }
          }
 else {
            throw new InvalidParameterValueException("String_Node_Str" + accountName + "String_Node_Str"+ domain.getUuid()+ "String_Node_Str"+ "String_Node_Str");
          }
        }
      }
    }
);
    Map<String,Object> permit=new HashMap<String,Object>();
    permit.put(ApiConstants.ENTITY_TYPE,AclEntityType.VirtualMachineTemplate.toString());
    permit.put(ApiConstants.ENTITY_ID,id);
    permit.put(ApiConstants.ACCESS_TYPE,AccessType.UseEntry);
    permit.put(ApiConstants.ACL_ACTION,"String_Node_Str");
    permit.put(ApiConstants.ACCOUNTS,accountIds);
    _messageBus.publish(_name,EntityManager.MESSAGE_GRANT_ENTITY_EVENT,PublishScope.LOCAL,permit);
  }
 else   if ("String_Node_Str".equalsIgnoreCase(operation)) {
    List<Long> accountIds=new ArrayList<Long>();
    for (    String accountName : accountNames) {
      Account permittedAccount=_accountDao.findActiveAccount(accountName,domain.getId());
      if (permittedAccount != null) {
        accountIds.add(permittedAccount.getId());
      }
    }
    _launchPermissionDao.removePermissions(id,accountIds);
    Map<String,Object> permit=new HashMap<String,Object>();
    permit.put(ApiConstants.ENTITY_TYPE,AclEntityType.VirtualMachineTemplate.toString());
    permit.put(ApiConstants.ENTITY_ID,id);
    permit.put(ApiConstants.ACCESS_TYPE,AccessType.UseEntry);
    permit.put(ApiConstants.ACL_ACTION,"String_Node_Str");
    permit.put(ApiConstants.ACCOUNTS,accountIds);
    _messageBus.publish(_name,EntityManager.MESSAGE_REVOKE_ENTITY_EVENT,PublishScope.LOCAL,permit);
  }
 else   if ("String_Node_Str".equalsIgnoreCase(operation)) {
    updatedTemplate=_tmpltDao.createForUpdate();
    updatedTemplate.setPublicTemplate(false);
    updatedTemplate.setFeatured(false);
    _tmpltDao.update(template.getId(),updatedTemplate);
    _launchPermissionDao.removeAllPermissions(id);
    _messageBus.publish(_name,TemplateManager.MESSAGE_RESET_TEMPLATE_PERMISSION_EVENT,PublishScope.LOCAL,template.getId());
  }
  return true;
}