  def set_auth_groups
    Log.add_info(request, params.inspect)

    @folder = Folder.find(params[:id])

    if Folder.check_user_auth(@folder.id, @login_user, 'w', true)
      read_groups = []
      write_groups = []
      groups_auth = params[:groups_auth]
      unless groups_auth.nil?
        groups_auth.each do |auth_param|
          user_id = auth_param.split(':').first
          auths = auth_param.split(':').last.split('+')
          if auths.include?('r')
            read_groups << user_id
          end
          if auths.include?('w')
            write_groups << user_id
          end
        end
      end

      @folder.set_read_groups read_groups
      @folder.set_write_groups write_groups

      @folder.save

      flash[:notice] = t('msg.register_success')
    else
      flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
    end

    @groups = Group.where(nil).to_a
    render(:partial => 'ajax_auth_groups', :layout => false)

  rescue => evar
    Log.add_error(request, evar)
    render(:partial => 'ajax_auth_groups', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.