  def duplicate
    Log.add_info(request, params.inspect)

    return unless request.post?

    copies_folder = ItemsHelper.get_copies_folder(@login_user.id)

    item = Item.find(params[:id])
    if item.is_a_copy?
      flash[:notice] = 'ERROR:' + t('msg.system_error')
    else
      item.xtype = Item::XTYPE_INFO
      item.public = false
      item.title += ItemsHelper.get_next_revision(@login_user.id, item.id)
      copied_item = item.copy(@login_user.id, copies_folder.id, [:image, :attachment])

      flash[:notice] = "#{t('msg.save_success')}#{t('cap.suffix')}<br/>#{copied_item.title}"
    end

    render(:partial => 'common/flash_notice', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.