    public function setHomePage()
    {
        if (!$this->request->is('post')) {
            throw new MethodNotAllowedException(__('This endpoint only aaccepts POST requests.'));
        }
        if (empty($this->request->data['path'])) {
            $this->request->data = array('path' => $this->request->data);
        }
        if (empty($this->request->data['path'])) {
            throw new InvalidArgumentException(__('No path POSTed.'));
        }
        $setting = array(
            'UserSetting' => array(
                'user_id' => $this->Auth->user('id'),
                'setting' => 'homepage',
                'value' => json_encode(array('path' => $this->request->data['path']))
            )
        );
        $result = $this->UserSetting->setSetting($this->Auth->user(), $setting);
        return $this->RestResponse->saveSuccessResponse('UserSettings', 'setHomePage', false, $this->response->type(), 'Homepage set to ' . $this->request->data['path']);
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.