function checkCredentials(req, res, next) {
    if (!sqlInit.isDbInitialized()) {
        res.status(400).send('Database is not initialized yet.');
        return;
    }

    if (!passwordService.isPasswordSet()) {
        res.status(400).send('Password has not been set yet. Please set a password and repeat the action');
        return;
    }

    const header = req.headers['trilium-cred'] || '';
    const auth = new Buffer.from(header, 'base64').toString();
    const [username, password] = auth.split(/:/);

    // username is ignored

    if (!passwordEncryptionService.verifyPassword(password)) {
        res.status(401).send('Incorrect password');
    }
    else {
        next();
    }
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.