Program: 84525
Project: 84525
Buggy source:
/** 
 * @see org.springframework.web.servlet.mvc.AbstractFormController#processFormSubmission(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse,java.lang.Object,org.springframework.validation.BindException)
 */
protected ModelAndView processFormSubmission(HttpServletRequest request,HttpServletResponse response,Object obj,BindException errors) throws Exception {
  HttpSession httpSession=request.getSession();
  User user=(User)obj;
  UserService us=Context.getUserService();
  MessageSourceAccessor msa=getMessageSourceAccessor();
  String action=request.getParameter("String_Node_Str");
  if (!Context.isAuthenticated()) {
    errors.reject("String_Node_Str");
  }
 else   if (msa.getMessage("String_Node_Str").equals(action)) {
    Context.becomeUser(user.getSystemId());
    httpSession.setAttribute(WebConstants.OPENMRS_MSG_ATTR,"String_Node_Str");
    httpSession.setAttribute(WebConstants.OPENMRS_MSG_ARGS,user.getPersonName());
    return new ModelAndView(new RedirectView(request.getContextPath() + "String_Node_Str"));
  }
 else   if (msa.getMessage("String_Node_Str").equals(action)) {
    us.purgeUser(user);
    return new ModelAndView(new RedirectView(getSuccessView()));
  }
 else {
    if (us.hasDuplicateUsername(user))     errors.rejectValue("String_Node_Str","String_Node_Str");
    String password=request.getParameter("String_Node_Str");
    if (password == null || password.equals("String_Node_Str"))     password="String_Node_Str";
    String confirm=request.getParameter("String_Node_Str");
    if (confirm == null || confirm.equals("String_Node_Str"))     confirm="String_Node_Str";
    if (!password.equals(confirm))     errors.reject("String_Node_Str");
    if (password.length() == 0 && isNewUser(user))     errors.reject("String_Node_Str");
    if (password.length() > 0) {
      try {
        OpenmrsUtil.validatePassword(user.getUsername(),password,String.valueOf(user.getUserId()));
      }
 catch (      PasswordException e) {
        errors.reject(e.getMessage());
      }
    }
    String[] roles=request.getParameterValues("String_Node_Str");
    Set<Role> newRoles=new HashSet<Role>();
    if (roles != null) {
      for (      String r : roles) {
        Role role=null;
        if (user.getRoles() != null)         for (        Role test : user.getRoles())         if (test.getRole().equals(r))         role=test;
        if (role == null) {
          role=us.getRole(r);
          user.addRole(role);
        }
        newRoles.add(role);
      }
    }
    if (user.getRoles() == null)     newRoles.clear();
 else     user.getRoles().retainAll(newRoles);
  }
  return super.processFormSubmission(request,response,user,errors);
}

Fixed version (ground truth):
/** 
 * @see org.springframework.web.servlet.mvc.AbstractFormController#processFormSubmission(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse,java.lang.Object,org.springframework.validation.BindException)
 */
protected ModelAndView processFormSubmission(HttpServletRequest request,HttpServletResponse response,Object obj,BindException errors) throws Exception {
  HttpSession httpSession=request.getSession();
  User user=(User)obj;
  UserService us=Context.getUserService();
  MessageSourceAccessor msa=getMessageSourceAccessor();
  String action=request.getParameter("String_Node_Str");
  if (!Context.isAuthenticated()) {
    errors.reject("String_Node_Str");
  }
 else   if (msa.getMessage("String_Node_Str").equals(action)) {
    Context.becomeUser(user.getSystemId());
    httpSession.setAttribute(WebConstants.OPENMRS_MSG_ATTR,"String_Node_Str");
    httpSession.setAttribute(WebConstants.OPENMRS_MSG_ARGS,user.getPersonName());
    return new ModelAndView(new RedirectView(request.getContextPath() + "String_Node_Str"));
  }
 else   if (msa.getMessage("String_Node_Str").equals(action)) {
    us.purgeUser(user);
    return new ModelAndView(new RedirectView(getSuccessView()));
  }
 else {
    if (us.hasDuplicateUsername(user))     errors.rejectValue("String_Node_Str","String_Node_Str");
    String password=request.getParameter("String_Node_Str");
    if (password == null || password.equals("String_Node_Str"))     password="String_Node_Str";
    String confirm=request.getParameter("String_Node_Str");
    if (confirm == null || confirm.equals("String_Node_Str"))     confirm="String_Node_Str";
    if (!password.equals(confirm))     errors.reject("String_Node_Str");
    if (password.length() == 0 && isNewUser(user))     errors.reject("String_Node_Str");
    if (password.length() > 0) {
      try {
        OpenmrsUtil.validatePassword(user.getUsername(),password,user.getSystemId());
      }
 catch (      PasswordException e) {
        errors.reject(e.getMessage());
      }
    }
    String[] roles=request.getParameterValues("String_Node_Str");
    Set<Role> newRoles=new HashSet<Role>();
    if (roles != null) {
      for (      String r : roles) {
        Role role=null;
        if (user.getRoles() != null)         for (        Role test : user.getRoles())         if (test.getRole().equals(r))         role=test;
        if (role == null) {
          role=us.getRole(r);
          user.addRole(role);
        }
        newRoles.add(role);
      }
    }
    if (user.getRoles() == null)     newRoles.clear();
 else     user.getRoles().retainAll(newRoles);
  }
  return super.processFormSubmission(request,response,user,errors);
}