    public function actionHideWidget() {
        if (isset($_POST['name'])) {
            $name = $_POST['name'];

            $layout = Yii::app()->params->profile->getLayout();

            // the widget could be in any of the blocks in the page, so check all of them
            foreach ($layout as $b => &$block) {
                if (isset($block[$name])) {
                    if ($b == 'right') {
                        $layout['hiddenRight'][$name] = $block[$name];
                    } else {
                        $layout['hidden'][$name] = $block[$name];
                    }
                    unset($block[$name]);
                    Yii::app()->params->profile->saveLayout($layout);
                    break;
                }
            }

            // make a list of hidden widgets, using <li>, to send back to the browser
            $list = "";
            foreach ($layout['hidden'] as $name => $widget) {
                $list .= "<li><span class=\"x2-widget-menu-item\" id=\"$name\">{$widget['title']}</span></li>";
            }
            foreach ($layout['hiddenRight'] as $name => $widget) {
                $list .= "<li><span class=\"x2-widget-menu-item right\" id=\"$name\">{$widget['title']}</span></li>";
            }

            echo Yii::app()->params->profile->getWidgetMenu();
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.