Program: 84519
Project: 84519
Buggy source:
/** 
 * The onSubmit function receives the form/command object that was modified by the input form and saves it to the db
 * @see org.springframework.web.servlet.mvc.SimpleFormController#onSubmit(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse,java.lang.Object,org.springframework.validation.BindException)
 */
protected ModelAndView onSubmit(HttpServletRequest request,HttpServletResponse response,Object obj,BindException errors) throws Exception {
  HttpSession httpSession=request.getSession();
  String view=getFormView();
  if (!errors.hasErrors()) {
    User loginUser=Context.getAuthenticatedUser();
    UserService us=Context.getUserService();
    User user=null;
    try {
      Context.addProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
      user=us.getUser(loginUser.getUserId());
    }
  finally {
      Context.removeProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
    }
    OptionsForm opts=(OptionsForm)obj;
    Map<String,String> properties=user.getUserProperties();
    properties.put(OpenmrsConstants.USER_PROPERTY_DEFAULT_LOCATION,opts.getDefaultLocation());
    properties.put(OpenmrsConstants.USER_PROPERTY_DEFAULT_LOCALE,opts.getDefaultLocale());
    properties.put(OpenmrsConstants.USER_PROPERTY_PROFICIENT_LOCALES,opts.getProficientLocales());
    properties.put(OpenmrsConstants.USER_PROPERTY_SHOW_RETIRED,opts.getShowRetiredMessage().toString());
    properties.put(OpenmrsConstants.USER_PROPERTY_SHOW_VERBOSE,opts.getVerbose().toString());
    properties.put(OpenmrsConstants.USER_PROPERTY_NOTIFICATION,opts.getNotification() == null ? "String_Node_Str" : opts.getNotification().toString());
    properties.put(OpenmrsConstants.USER_PROPERTY_NOTIFICATION_ADDRESS,opts.getNotificationAddress().toString());
    if (!opts.getOldPassword().equals("String_Node_Str")) {
      try {
        String password=opts.getNewPassword();
        if (password.length() > 0) {
          try {
            OpenmrsUtil.validatePassword(user.getUsername(),password,String.valueOf(user.getUserId()));
          }
 catch (          PasswordException e) {
            errors.reject(e.getMessage());
          }
          if (password.equals(opts.getOldPassword()) && !errors.hasErrors())           errors.reject("String_Node_Str");
        }
        if (!errors.hasErrors()) {
          us.changePassword(opts.getOldPassword(),password);
          if (properties.containsKey(OpenmrsConstants.USER_PROPERTY_CHANGE_PASSWORD))           properties.remove(OpenmrsConstants.USER_PROPERTY_CHANGE_PASSWORD);
        }
      }
 catch (      APIException e) {
        errors.rejectValue("String_Node_Str","String_Node_Str");
      }
    }
 else {
      if (!opts.getNewPassword().equals("String_Node_Str")) {
        errors.rejectValue("String_Node_Str","String_Node_Str");
      }
    }
    if (!opts.getSecretQuestionPassword().equals("String_Node_Str")) {
      if (!errors.hasErrors()) {
        try {
          user.setSecretQuestion(opts.getSecretQuestionNew());
          us.changeQuestionAnswer(opts.getSecretQuestionPassword(),opts.getSecretQuestionNew(),opts.getSecretAnswerNew());
        }
 catch (        APIException e) {
          errors.rejectValue("String_Node_Str","String_Node_Str");
        }
      }
    }
 else     if (!opts.getSecretAnswerNew().equals("String_Node_Str")) {
      errors.rejectValue("String_Node_Str","String_Node_Str");
    }
    if (opts.getUsername().length() > 0 && !errors.hasErrors()) {
      try {
        Context.addProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
        if (us.hasDuplicateUsername(user)) {
          errors.rejectValue("String_Node_Str","String_Node_Str");
        }
      }
  finally {
        Context.removeProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
      }
    }
    if (!errors.hasErrors()) {
      user.setUsername(opts.getUsername());
      user.setUserProperties(properties);
      PersonName newPersonName=opts.getPersonName();
      PersonName existingPersonName=user.getPersonName();
      if (!existingPersonName.equalsContent(newPersonName)) {
        existingPersonName.setPreferred(false);
        existingPersonName.setVoided(true);
        existingPersonName.setVoidedBy(user);
        existingPersonName.setDateVoided(new Date());
        existingPersonName.setVoidReason("String_Node_Str");
        newPersonName.setPreferred(true);
        user.addName(newPersonName);
      }
      try {
        Context.addProxyPrivilege(OpenmrsConstants.PRIV_EDIT_USERS);
        Context.addProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
        us.saveUser(user,null);
        Context.refreshAuthenticatedUser();
      }
  finally {
        Context.removeProxyPrivilege(OpenmrsConstants.PRIV_EDIT_USERS);
        Context.removeProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
      }
      httpSession.setAttribute(WebConstants.OPENMRS_MSG_ATTR,"String_Node_Str");
    }
 else {
      return super.processFormSubmission(request,response,opts,errors);
    }
    view=getSuccessView();
  }
  return new ModelAndView(new RedirectView(view));
}

Fixed version (ground truth):
/** 
 * The onSubmit function receives the form/command object that was modified by the input form and saves it to the db
 * @see org.springframework.web.servlet.mvc.SimpleFormController#onSubmit(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse,java.lang.Object,org.springframework.validation.BindException)
 */
protected ModelAndView onSubmit(HttpServletRequest request,HttpServletResponse response,Object obj,BindException errors) throws Exception {
  HttpSession httpSession=request.getSession();
  String view=getFormView();
  if (!errors.hasErrors()) {
    User loginUser=Context.getAuthenticatedUser();
    UserService us=Context.getUserService();
    User user=null;
    try {
      Context.addProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
      user=us.getUser(loginUser.getUserId());
    }
  finally {
      Context.removeProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
    }
    OptionsForm opts=(OptionsForm)obj;
    Map<String,String> properties=user.getUserProperties();
    properties.put(OpenmrsConstants.USER_PROPERTY_DEFAULT_LOCATION,opts.getDefaultLocation());
    properties.put(OpenmrsConstants.USER_PROPERTY_DEFAULT_LOCALE,opts.getDefaultLocale());
    properties.put(OpenmrsConstants.USER_PROPERTY_PROFICIENT_LOCALES,opts.getProficientLocales());
    properties.put(OpenmrsConstants.USER_PROPERTY_SHOW_RETIRED,opts.getShowRetiredMessage().toString());
    properties.put(OpenmrsConstants.USER_PROPERTY_SHOW_VERBOSE,opts.getVerbose().toString());
    properties.put(OpenmrsConstants.USER_PROPERTY_NOTIFICATION,opts.getNotification() == null ? "String_Node_Str" : opts.getNotification().toString());
    properties.put(OpenmrsConstants.USER_PROPERTY_NOTIFICATION_ADDRESS,opts.getNotificationAddress().toString());
    if (!opts.getOldPassword().equals("String_Node_Str")) {
      try {
        String password=opts.getNewPassword();
        if (password.length() > 0) {
          try {
            OpenmrsUtil.validatePassword(user.getUsername(),password,String.valueOf(user.getUserId()));
          }
 catch (          PasswordException e) {
            errors.reject(e.getMessage());
          }
          if (password.equals(opts.getOldPassword()) && !errors.hasErrors())           errors.reject("String_Node_Str");
        }
        if (!errors.hasErrors()) {
          us.changePassword(opts.getOldPassword(),password);
          opts.setSecretQuestionPassword(password);
          if (properties.containsKey(OpenmrsConstants.USER_PROPERTY_CHANGE_PASSWORD))           properties.remove(OpenmrsConstants.USER_PROPERTY_CHANGE_PASSWORD);
        }
      }
 catch (      APIException e) {
        errors.rejectValue("String_Node_Str","String_Node_Str");
      }
    }
 else {
      if (!opts.getNewPassword().equals("String_Node_Str")) {
        errors.rejectValue("String_Node_Str","String_Node_Str");
      }
    }
    if (!opts.getSecretQuestionPassword().equals("String_Node_Str")) {
      if (!errors.hasErrors()) {
        try {
          user.setSecretQuestion(opts.getSecretQuestionNew());
          us.changeQuestionAnswer(opts.getSecretQuestionPassword(),opts.getSecretQuestionNew(),opts.getSecretAnswerNew());
        }
 catch (        APIException e) {
          errors.rejectValue("String_Node_Str","String_Node_Str");
        }
      }
    }
 else     if (!opts.getSecretAnswerNew().equals("String_Node_Str")) {
      errors.rejectValue("String_Node_Str","String_Node_Str");
    }
    if (opts.getUsername().length() > 0 && !errors.hasErrors()) {
      try {
        Context.addProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
        if (us.hasDuplicateUsername(user)) {
          errors.rejectValue("String_Node_Str","String_Node_Str");
        }
      }
  finally {
        Context.removeProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
      }
    }
    if (!errors.hasErrors()) {
      user.setUsername(opts.getUsername());
      user.setUserProperties(properties);
      PersonName newPersonName=opts.getPersonName();
      PersonName existingPersonName=user.getPersonName();
      if (!existingPersonName.equalsContent(newPersonName)) {
        existingPersonName.setPreferred(false);
        existingPersonName.setVoided(true);
        existingPersonName.setVoidedBy(user);
        existingPersonName.setDateVoided(new Date());
        existingPersonName.setVoidReason("String_Node_Str");
        newPersonName.setPreferred(true);
        user.addName(newPersonName);
      }
      try {
        Context.addProxyPrivilege(OpenmrsConstants.PRIV_EDIT_USERS);
        Context.addProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
        us.saveUser(user,null);
        Context.refreshAuthenticatedUser();
      }
  finally {
        Context.removeProxyPrivilege(OpenmrsConstants.PRIV_EDIT_USERS);
        Context.removeProxyPrivilege(OpenmrsConstants.PRIV_VIEW_USERS);
      }
      httpSession.setAttribute(WebConstants.OPENMRS_MSG_ATTR,"String_Node_Str");
    }
 else {
      return super.processFormSubmission(request,response,opts,errors);
    }
    view=getSuccessView();
  }
  return new ModelAndView(new RedirectView(view));
}