  def update_auth
    Log.add_info(request, params.inspect)

    return unless request.post?

    auth = nil

    if params[:check_auth_all] == '1'

      auth = User::AUTH_ALL

    else

      auth_selected = params[:auth_selected]

      unless auth_selected.nil? or auth_selected.empty?
        auth = '|' + auth_selected.join('|') + '|'
      end

      if auth_selected.nil? or !auth_selected.include?(User::AUTH_USER)

        user_admin_err = false

        user_admins = User.where("auth like '%|#{User::AUTH_USER}|%' or auth='#{User::AUTH_ALL}'").to_a

        if user_admins.nil? or user_admins.empty?

          user_admin_err = true

        elsif user_admins.length == 1

          if user_admins.first.id.to_s == params[:id]
            user_admin_err = true
          end

        end

        if user_admin_err
          render(:text => t('user.no_user_auth'))
          return
        end
      end

    end

    begin
      user = User.find(params[:id])
    rescue => evar
      Log.add_error(request, evar)
    end

    if user.nil?

      render(:text => t('msg.already_deleted', :name => User.model_name.human))
    else

      user.update_attribute(:auth, auth)

      if user.id == @login_user.id
        @login_user = user
      end

      render(:text => '')
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.