  def list
    if params[:action] == 'list'
      Log.add_info(request, params.inspect)
    end

    @folder_id = nil
    if !params[:thetisBoxSelKeeper].nil?
      @folder_id = params[:thetisBoxSelKeeper].split(':').last

      if !@folder_id.nil? and @folder_id.index('+') == 0
        @folder_id[0, 1] = ''
      end
    elsif params[:folder_id].blank?
    else
      @folder_id = params[:folder_id]
    end
    SqlHelper.validate_token([@folder_id])

    unless @folder_id.nil?
      session[:folder_id] = @folder_id

      unless Folder.check_user_auth(@folder_id, @login_user, 'r', true)
        flash[:notice] = 'ERROR:' + t('folder.need_auth_to_read')
      end
    end

# Copy to FEATURE_PAGING_IN_TREE >>>
    @sort_col = params[:sort_col]
    @sort_type = params[:sort_type]

    if @sort_col.blank? or @sort_type.blank?
      @sort_col, @sort_type = FoldersHelper.get_sort_params(@folder_id)
    end

    folder_ids = nil
    add_con = nil

    if @folder_id.nil? and params[:find_in] != Item::FOLDER_ALL
      add_con = "(Item.folder_id != 0) and (Folder.disp_ctrl like '%|#{Folder::DISPCTRL_BBS_TOP}|%')"
    else
      case params[:find_in]
        when Item::FOLDER_ALL
          ;
        when Item::FOLDER_CURRENT
          folder_ids = [@folder_id]
        when Item::FOLDER_LOWER
          folder_ids = Folder.get_childs(@folder_id, nil, true, false, false)
          folder_ids.unshift(@folder_id)
        else
          folder_ids = [@folder_id]
      end
      unless folder_ids.nil?
        delete_ary = []
        folder_ids.each do |folder_id|
          unless Folder.check_user_auth(folder_id, @login_user, 'r', true)
            delete_ary << folder_id
          end
        end
        folder_ids -= delete_ary unless delete_ary.empty?
      end
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.