		postUrl = `${config().baseUrl}/users/${user.id}`;
	}

	const subscription = !isNew ? await ctx.joplin.models.subscription().byUserId(userId) : null;

	const view: View = defaultView('user', 'Profile');
	view.content.user = user;
	view.content.isNew = isNew;
	view.content.buttonTitle = isNew ? 'Create user' : 'Update profile';
	view.content.error = error;
	view.content.postUrl = postUrl;
	view.content.showDisableButton = !isNew && !!owner.is_admin && owner.id !== user.id && user.enabled;
	view.content.csrfTag = await createCsrfTag(ctx);

	if (subscription) {
		view.content.subscription = subscription;
		view.content.showCancelSubscription = !isNew;
		view.content.showUpdateSubscriptionBasic = !isNew && !!owner.is_admin && user.account_type !== AccountType.Basic;
		view.content.showUpdateSubscriptionPro = !isNew && user.account_type !== AccountType.Pro;
	}

	view.content.showRestoreButton = !isNew && !!owner.is_admin && !user.enabled;
	view.content.showResetPasswordButton = !isNew && owner.is_admin && user.enabled;
	view.content.canSetEmail = isNew || owner.is_admin;
	view.content.canShareFolderOptions = yesNoDefaultOptions(user, 'can_share_folder');
	view.jsFiles.push('zxcvbn');
	view.cssFiles.push('index/user');

	if (config().accountTypesEnabled) {
		view.content.showAccountTypes = true;
		view.content.accountTypes = accountTypeOptions().map((o: any) => {
			o.selected = user.account_type === o.value;
			return o;
		});
	}

	return view;
});
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.