  def move
    Log.add_info(request, params.inspect)

    return unless request.post?

    @folder = Folder.find(params[:id])

    if params[:thetisBoxSelKeeper].blank?
      redirect_to(:action => 'show_tree')
      return
    end

    parent_id = params[:thetisBoxSelKeeper].split(':').last

    check = true

    unless Folder.check_user_auth(parent_id, @login_user, 'w', true)
      check = false
    end

    unless Folder.check_user_auth(@folder.id, @login_user, 'w', true)
      check = false
    end

    unless check
      flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
      redirect_to(:action => 'show_tree')
      return
    end

    # Check if specified parent is not one of subfolders.
    childs = Folder.get_childs(@folder.id, nil, true, true, false)
    if childs.include?(parent_id) or (@folder.id == parent_id.to_i)
      flash[:notice] = 'ERROR:' + t('folder.cannot_be_parent')
      redirect_to(:action => 'show_tree')
      return
    end

    @folder.parent_id = parent_id
    @folder.xorder = Folder.get_order_max(parent_id) + 1
    @folder.save
    redirect_to(:action => 'show_tree')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.