 App.Actions.WEB.update_custom_doc_root = function(elm, hint) {
    var prepath = $('input[name="v-custom-doc-root_prepath"]').val();
    var domain = $('select[name="v-custom-doc-domain"]').val();
    var folder = $('input[name="v-custom-doc-folder"]').val();
    console.log(domain, folder);
    $('.custom_docroot_hint').html(prepath+domain+'/public_html/'+folder);
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.