  def self.get_tree(folder_tree, conditions, parent, admin)

    if parent.instance_of?(Folder)
      tree_id = parent.id.to_s
    else
      tree_id = parent.to_s
      parent = nil
      if tree_id != '0'
        begin
          parent = Folder.find(tree_id)
        rescue
        end
        return folder_tree if parent.nil?
      end
    end

    group_obj_cache = {}
    folder_tree[tree_id] = []
    if !parent.nil? and (parent.xtype == Folder::XTYPE_GROUP)
      Group.get_childs(parent.owner_id, false, true).each do |group|
        group_obj_cache[group.id] = group
        con = Marshal.load(Marshal.dump(conditions)) unless conditions.nil?
        if con.nil?
          con = ''
        else
          con << ' and '
        end
        con << "(xtype='#{Folder::XTYPE_GROUP}') and (owner_id=#{group.id})"
        begin
          group_folder = Folder.where(con).first
        rescue => evar
          Log.add_error(nil, evar)
        end
        unless group_folder.nil?
          folder_tree[tree_id] << group_folder
        end
      end
    end

    con = Marshal.load(Marshal.dump(conditions)) unless conditions.nil?
    if con.nil?
      con = ''
    else
      con << ' and '
    end
    con << "parent_id=#{tree_id}"
    folder_tree[tree_id] += Folder.where(con).order('xorder ASC, id ASC').to_a

    delete_ary = []

    folder_tree[tree_id].each do |folder|

      if !admin and (folder.xtype == Folder::XTYPE_SYSTEM)
        delete_ary << folder
        next
      end

      if (tree_id == '0') and (folder.xtype == Folder::XTYPE_GROUP)
        group = Group.find_with_cache(folder.owner_id, group_obj_cache)
        unless group.nil?
          if group.parent_id != 0
            delete_ary << folder
            next
          end
        end
      end

      folder_tree = Folder.get_tree(folder_tree, conditions, folder, admin)
    end

    folder_tree[tree_id] -= delete_ary

    return folder_tree
   end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.