  def get_items
    if params[:action] == 'get_items'
      Log.add_info(request, params.inspect)
    end

    @folder_id = params[:id]
    SqlHelper.validate_token([@folder_id])

    if Folder.check_user_auth(@folder_id, @login_user, 'r', true)
=begin
#      if !@login_user.nil? and @login_user.admin?(User::AUTH_ITEM)
#        @items = Folder.get_items_admin(@folder_id)
#      else
#        @items = Folder.get_items(@login_user, @folder_id)
#      end
=end

# FEATURE_PAGING_IN_TREE >>>
      @sort_col = params[:sort_col]
      @sort_type = params[:sort_type]

      if @sort_col.blank? or @sort_type.blank?
        @sort_col, @sort_type = FoldersHelper.get_sort_params(@folder_id)
      end
      SqlHelper.validate_token([@sort_col, @sort_type])

      folder_ids = nil
      add_con = nil

      if @folder_id.nil? and params[:find_in] != Item::FOLDER_ALL
        add_con = "(Item.folder_id != 0) and (Folder.disp_ctrl like '%|#{Folder::DISPCTRL_BBS_TOP}|%')"
      else
        case params[:find_in]
          when Item::FOLDER_ALL
            ;
          when Item::FOLDER_CURRENT
            folder_ids = [@folder_id]
          when Item::FOLDER_LOWER
            folder_ids = Folder.get_childs(@folder_id, nil, true, false, false)
            folder_ids.unshift(@folder_id)
          else
            folder_ids = [@folder_id]
        end
        unless folder_ids.nil?
          delete_ary = []
          folder_ids.each do |folder_id|
            unless Folder.check_user_auth(folder_id, @login_user, 'r', true)
              delete_ary << folder_id
            end
          end
          folder_ids -= delete_ary unless delete_ary.empty?
        end
      end

      sql = ItemsHelper.get_list_sql(@login_user, params[:keyword], folder_ids, @sort_col, @sort_type, 0, false, add_con)
      @item_pages, @items, @total_num = paginate_by_sql(Item, sql, 10)
# FEATURE_PAGING_IN_TREE <<<

    else
      @items = []

      flash[:notice] = 'ERROR:' + t('folder.need_auth_to_read')
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.