def login():
    from flask_login import current_user

    redirect_url = request.args.get("redirect", request.script_root + url_for("index"))
    permissions = sorted(
        filter(
            lambda x: x is not None and isinstance(x, OctoPrintPermission),
            map(
                lambda x: getattr(Permissions, x.strip()),
                request.args.get("permissions", "").split(","),
            ),
        ),
        key=lambda x: x.get_name(),
    )
    if not permissions:
        permissions = [Permissions.STATUS, Permissions.SETTINGS_READ]

    user_id = request.args.get("user_id", "")

    if (not user_id or current_user.get_id() == user_id) and has_permissions(
        *permissions
    ):
        return redirect(redirect_url)

    render_kwargs = {
        "theming": [],
        "redirect_url": redirect_url,
        "permission_names": map(lambda x: x.get_name(), permissions),
        "user_id": user_id,
        "logged_in": not current_user.is_anonymous,
    }

    try:
        additional_assets = _add_additional_assets("octoprint.theming.login")

        # backwards compatibility to forcelogin & loginui plugins which were replaced by this built-in dialog
        additional_assets += _add_additional_assets("octoprint.plugin.forcelogin.theming")
        additional_assets += _add_additional_assets("octoprint.plugin.loginui.theming")

        render_kwargs.update({"theming": additional_assets})
    except Exception:
        _logger.exception("Error processing theming CSS, ignoring")

    return render_template("login.jinja2", **render_kwargs)
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.