Program: 70061
Project: 70061
Buggy source:
/** 
 * Updates the catalog entry with the path specified in the URL.
 * @response.representation.200.qname {http://www.example.com}catalogEntryVO
 * @response.representation.200.mediaType application/xml, application/json
 * @response.representation.200.doc The catalog entry200.example  {@link org.olat.catalog.restapi.Examples#SAMPLE_CATALOGENTRYVO}
 * @response.representation.401.doc Not authorized
 * @response.representation.404.doc The path could not be resolved to a valid catalog entry
 * @param path The path
 * @param entryVo The catalog entry
 * @param httpRquest The HTTP request
 * @param uriInfo The URI informations
 * @return The response
 */
@POST @Path("String_Node_Str") @Consumes({MediaType.APPLICATION_XML,MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_XML,MediaType.APPLICATION_JSON}) public Response updateCatalogEntry(@PathParam("String_Node_Str") List<PathSegment> path,CatalogEntryVO entryVo,@Context HttpServletRequest httpRequest,@Context UriInfo uriInfo){
  if (!isAuthor(httpRequest)) {
    return Response.serverError().status(Status.UNAUTHORIZED).build();
  }
  Long key=getCatalogEntryKeyFromPath(path);
  if (key == null) {
    return Response.serverError().status(Status.NOT_ACCEPTABLE).build();
  }
  CatalogEntry ce=catalogManager.loadCatalogEntry(key);
  if (ce.getType() == CatalogEntry.TYPE_NODE) {
    if (!canAdminSubTree(ce,httpRequest)) {
      return Response.serverError().status(Status.UNAUTHORIZED).build();
    }
  }
  Identity id=getUserRequest(httpRequest).getIdentity();
  LockResult lock=CoordinatorManager.getInstance().getCoordinator().getLocker().acquireLock(catalogRes,id,LOCK_TOKEN);
  if (!lock.isSuccess()) {
    return getLockedResponse(lock,httpRequest);
  }
  try {
    ce=catalogManager.loadCatalogEntry(ce);
    if (ce == null) {
      return Response.serverError().status(Status.NOT_FOUND).build();
    }
    ce.setName(entryVo.getName());
    ce.setDescription(entryVo.getDescription());
    ce.setType(guessType(entryVo));
    catalogManager.updateCatalogEntry(ce);
  }
 catch (  Exception e) {
    throw new WebApplicationException(e);
  }
 finally {
    CoordinatorManager.getInstance().getCoordinator().getLocker().releaseLock(lock);
  }
  CatalogEntryVO newEntryVo=link(get(ce),uriInfo);
  return Response.ok(newEntryVo).build();
}

Fixed version (ground truth):
/** 
 * Updates the catalog entry with the path specified in the URL.
 * @response.representation.200.qname {http://www.example.com}catalogEntryVO
 * @response.representation.200.mediaType application/xml, application/json
 * @response.representation.200.doc The catalog entry200.example  {@link org.olat.catalog.restapi.Examples#SAMPLE_CATALOGENTRYVO}
 * @response.representation.401.doc Not authorized
 * @response.representation.404.doc The path could not be resolved to a valid catalog entry
 * @param path The path
 * @param entryVo The catalog entry
 * @param newParentKey The parent key to move the entry (optional)
 * @param httpRquest The HTTP request
 * @param uriInfo The URI informations
 * @return The response
 */
@POST @Path("String_Node_Str") @Consumes({MediaType.APPLICATION_XML,MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_XML,MediaType.APPLICATION_JSON}) public Response updateCatalogEntry(@PathParam("String_Node_Str") List<PathSegment> path,CatalogEntryVO entryVo,@QueryParam("String_Node_Str") Long newParentKey,@Context HttpServletRequest httpRequest,@Context UriInfo uriInfo){
  if (!isAuthor(httpRequest)) {
    return Response.serverError().status(Status.UNAUTHORIZED).build();
  }
  Long key=getCatalogEntryKeyFromPath(path);
  if (key == null) {
    return Response.serverError().status(Status.NOT_ACCEPTABLE).build();
  }
  CatalogEntry ce=catalogManager.loadCatalogEntry(key);
  if (ce.getType() == CatalogEntry.TYPE_NODE) {
    if (!canAdminSubTree(ce,httpRequest)) {
      return Response.serverError().status(Status.UNAUTHORIZED).build();
    }
  }
  CatalogEntry newParent=null;
  if (newParentKey != null) {
    newParent=catalogManager.loadCatalogEntry(newParentKey);
    if (newParent.getType() == CatalogEntry.TYPE_NODE) {
      if (!canAdminSubTree(newParent,httpRequest)) {
        return Response.serverError().status(Status.UNAUTHORIZED).build();
      }
    }
  }
  Identity id=getUserRequest(httpRequest).getIdentity();
  LockResult lock=CoordinatorManager.getInstance().getCoordinator().getLocker().acquireLock(catalogRes,id,LOCK_TOKEN);
  if (!lock.isSuccess()) {
    return getLockedResponse(lock,httpRequest);
  }
  try {
    ce=catalogManager.loadCatalogEntry(ce);
    if (ce == null) {
      return Response.serverError().status(Status.NOT_FOUND).build();
    }
    if (StringHelper.containsNonWhitespace(entryVo.getName())) {
      ce.setName(entryVo.getName());
    }
    if (StringHelper.containsNonWhitespace(entryVo.getDescription())) {
      ce.setDescription(entryVo.getDescription());
    }
    if (entryVo.getType() != null) {
      ce.setType(guessType(entryVo));
    }
    catalogManager.updateCatalogEntry(ce);
    if (newParent != null) {
      catalogManager.moveCatalogEntry(ce,newParent);
    }
  }
 catch (  Exception e) {
    throw new WebApplicationException(e);
  }
 finally {
    CoordinatorManager.getInstance().getCoordinator().getLocker().releaseLock(lock);
  }
  CatalogEntryVO newEntryVo=link(get(ce),uriInfo);
  return Response.ok(newEntryVo).build();
}