--- a/src/main/java/de/intevation/lada/rest/exporter/LafExportService.java	Fri Nov 18 16:56:33 2016 +0100
+++ b/src/main/java/de/intevation/lada/rest/exporter/LafExportService.java	Fri Nov 18 19:50:17 2016 +0100
@@ -14,6 +14,8 @@
 import javax.enterprise.context.RequestScoped;
 import javax.inject.Inject;
 import javax.json.JsonArray;
+import javax.json.JsonValue;
+import javax.json.JsonNumber;
 import javax.json.JsonObject;
 import javax.servlet.http.HttpServletRequest;
 import javax.ws.rs.Consumes;
@@ -24,10 +26,15 @@
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.Response.ResponseBuilder;
 
+import de.intevation.lada.model.land.Probe;
 import de.intevation.lada.exporter.ExportConfig;
 import de.intevation.lada.exporter.ExportFormat;
 import de.intevation.lada.exporter.Exporter;
 import de.intevation.lada.util.annotation.AuthorizationConfig;
+import de.intevation.lada.util.annotation.RepositoryConfig;
+import de.intevation.lada.util.data.QueryBuilder;
+import de.intevation.lada.util.data.Repository;
+import de.intevation.lada.util.data.RepositoryType;
 import de.intevation.lada.util.auth.Authorization;
 import de.intevation.lada.util.auth.AuthorizationType;
 import de.intevation.lada.util.auth.UserInfo;
@@ -52,6 +59,13 @@
 public class LafExportService {
 
     /**
+     * The data repository granting read-only access.
+     */
+    @Inject
+    @RepositoryConfig(type=RepositoryType.RO)
+    private Repository repository;
+
+    /**
      * The exporter.
      */
     @Inject
@@ -84,21 +98,34 @@
         JsonObject proben,
         @Context HttpServletRequest request
     ) {
-        JsonArray array = proben.getJsonArray("proben");
+        List<Integer> providedIds = new ArrayList<Integer>();
+        for (JsonValue id : proben.getJsonArray("proben")) {
+            if (id instanceof JsonNumber) {
+                providedIds.add(((JsonNumber)id).intValue());
+            }
+        }
+
+        QueryBuilder<Probe> pBuilder = new QueryBuilder<Probe>(
+            repository.entityManager("land"), Probe.class);
+        pBuilder.andIn("id", providedIds);
+        List<Probe> pObjects = repository.filterPlain(
+            pBuilder.getQuery(), "land");
+
+        if (pObjects.isEmpty()) {
+            return Response.status(Response.Status.NOT_FOUND).build();
+        }
+
         List<Integer> probeIds = new ArrayList<Integer>();
-        String fileName = "export.laf";
+        for (Probe p : pObjects) {
+            probeIds.add(p.getId());
+        }
         UserInfo userInfo = authorization.getInfo(request);
-        for (int i = 0; i < array.size(); i++) {
-            Integer probeId = array.getInt(i);
-            //if (authorization.isAuthorized(userInfo, probeId)) {
-                probeIds.add(probeId);
-            //}
-        }
         InputStream exported = exporter.export(probeIds, userInfo);
+
         ResponseBuilder response = Response.ok((Object)exported);
         response.header(
             "Content-Disposition",
-            "attachment; filename=\"" + fileName + "\"");
+            "attachment; filename=\"export.laf\"");
         return response.build();
     }
 }