    public function isVisibleTo ($user) {
        if (Yii::app()->params->isAdmin) return true;
        if (!$user) return false;

        $assignedUser = null;
        if ($this->associationType === 'User') {
            $assignedUser = User::model ()->findByPk ($this->associationId);
        }
        switch (Yii::app()->settings->historyPrivacy) { 
            case 'group':
                if (in_array ($this->user, Groups::getGroupmates ($user->id)) ||
                    ($this->associationType === 'User' && 
                     $assignedUser &&
                     in_array ($assignedUser->username, Groups::getGroupmates ($user->id)))) {

                    return true;
                }
                // fall through
            case 'user':
                if ($this->user === $user->username ||
                    ($this->associationType === 'User' && 
                     ($this->associationId === $user->id))) {

                    return true;
                }
                break;
            default: // default history privacy (public or assigned)
                return ($this->user === $user->username || $this->visibility ||
                    $this->associationType === 'User' && $this->associationId === $user->id);
        }
        return false;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.