  def show_tree
    Log.add_info(request, params.inspect)

    if !@login_user.nil? and @login_user.admin?(User::AUTH_FOLDER)

      @group_id = nil
      if !params[:thetisBoxSelKeeper].nil?
        @group_id = params[:thetisBoxSelKeeper].split(':').last
      elsif !params[:group_id].nil? and !params[:group_id].empty?
        @group_id = params[:group_id]
      end

      @folder_tree = Folder.get_tree_by_group_for_admin(@group_id || '0')
    else
      @folder_tree = Folder.get_tree_for(@login_user)
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.