  def save_conf
    Log.add_info(request, '')   # Not to show passwords.

    return unless request.post?

    unless @login_user.nil?

      if @login_user.paintmail.nil?
        paintmail = Paintmail.new(params.require(:paintmail).permit(Paintmail::PERMIT_BASE))
        paintmail.user_id = @login_user.id
        paintmail.save
      else
        @login_user.paintmail.update_attributes(params.require(:paintmail).permit(Paintmail::PERMIT_BASE))
      end
    end

    render(:text => '')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.