    public function index($id)
    {

        //check permissions
        $template = $this->TemplateElement->Template->checkAuthorisation($id, $this->Auth->user(), false);
        if (!$this->_isSiteAdmin() && !$template) {
            throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to see it.');
        }

        $templateElements = $this->TemplateElement->find('all', array(
            'conditions' => array(
                'template_id' => $id,
            ),
            'contain' => array(
                'TemplateElementAttribute',
                'TemplateElementText',
                'TemplateElementFile'
            ),
            'order' => array('TemplateElement.position ASC')
        ));
        $this->loadModel('Attribute');
        $this->set('validTypeGroups', $this->Attribute->validTypeGroups);
        $this->set('id', $id);
        $this->layout = 'ajaxTemplate';
        $this->set('elements', $templateElements);
        $mayModify = false;
        if ($this->_isSiteAdmin() || $template['Template']['org'] == $this->Auth->user('Organisation')['name']) {
            $mayModify = true;
        }
        $this->set('mayModify', $mayModify);
        $this->render('ajax/ajaxIndex');
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.