                $criteria->addCondition ("
                    $userCondition OR
                    user IN (
                        SELECT DISTINCT b.username 
                        FROM x2_group_to_user a JOIN x2_group_to_user b 
                        ON a.groupId=b.groupId 
                        WHERE a.username=:getAccessCriteria_username
                    ) OR (
                        associationType='User' AND associationId in (
                            SELECT DISTINCT b.id
                            FROM x2_group_to_user a JOIN x2_group_to_user b
                            ON a.groupId=b.groupId
                            WHERE a.userId=:getAccessCriteria_userId
                        )
                    )");
            } else { // default history privacy (public or assigned)
                $criteria->addCondition ("
                    $userCondition OR visibility=1
                ");
            }
        }

        if ($profile) {
            $criteria->params[':getAccessCriteria_profileUsername'] = $profile->username;
            /* only show events associated with current profile which current user has
              permission to see */
            $criteria->addCondition ("user=:getAccessCriteria_profileUsername");
            if (!Yii::app()->params->isAdmin) {
                $criteria->addCondition ("visibility=1");
            }
        }
        return $criteria;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.