OO-869: check if the list of identities or security groups is null/empty before querying

src/main/java/org/olat/basesecurity/BaseSecurityManager.java

@@ -637,6 +637,9 @@ public class BaseSecurityManager extends BasicManager implements BaseSecurity {
 
 	@Override
 	public boolean removeIdentityFromSecurityGroups(List<Identity> identities, List<SecurityGroup> secGroups) {
+		if(identities == null || identities.isEmpty()) return true;//nothing to do
+		if(secGroups == null || secGroups.isEmpty()) return true;//nothing to do
+		
 		StringBuilder sb = new StringBuilder();
 		sb.append("delete from ").append(SecurityGroupMembershipImpl.class.getName()).append(" as msi ")
 		  .append("  where msi.identity.key in (:identityKeys) and msi.securityGroup.key in (:secGroupKeys)");

src/test/java/org/olat/basesecurity/BaseSecurityManagerTest.java

@@ -240,6 +240,36 @@ public class BaseSecurityManagerTest extends OlatTestCase {
 		Assert.assertEquals(id2, members.get(0));
 	}
 	
+	@Test
+	public void testRemoveFromSecurityGroup_list() {
+		//create a security group with 2 identites
+		Identity id1 = JunitTestHelper.createAndPersistIdentityAsUser( "rm-3-sec-" + UUID.randomUUID().toString());
+		Identity id2 = JunitTestHelper.createAndPersistIdentityAsUser( "rm-4-sec-" + UUID.randomUUID().toString());
+		SecurityGroup secGroup = securityManager.createAndPersistSecurityGroup();
+		securityManager.addIdentityToSecurityGroup(id1, secGroup);
+		securityManager.addIdentityToSecurityGroup(id2, secGroup);
+		dbInstance.commitAndCloseSession();
+		
+		//remove the first one
+		List<Identity> ids = new ArrayList<Identity>();
+		ids.add(id1);
+		ids.add(id2);
+		securityManager.removeIdentityFromSecurityGroups(ids, Collections.singletonList(secGroup));
+		dbInstance.commitAndCloseSession();
+		
+		int countMembers = securityManager.countIdentitiesOfSecurityGroup(secGroup);
+		Assert.assertEquals(0, countMembers);
+		List<Identity> members = securityManager.getIdentitiesOfSecurityGroup(secGroup);
+		Assert.assertNotNull(members);
+		Assert.assertTrue(members.isEmpty());
+		
+		//check if robust against null and empty
+		securityManager.removeIdentityFromSecurityGroups(ids, Collections.<SecurityGroup>emptyList());
+		securityManager.removeIdentityFromSecurityGroups(Collections.<Identity>emptyList(), Collections.singletonList(secGroup));
+		securityManager.removeIdentityFromSecurityGroups(ids, null);
+		securityManager.removeIdentityFromSecurityGroups(null, Collections.singletonList(secGroup));
+	}
+	
 	/**
 	 * 
 	 */