    public function actionUpdate($id){
        $model = $this->loadModel($id);
        if (!$this->checkPermissions ($model, 'edit')) $this->denied ();

        if(isset($_POST['Media'])){
            // save media info
            $model->lastUpdated = time();
            $model->associationType = $_POST['Media']['associationType'];
            $model->associationId = $_POST['Media']['associationId'];
            $model->private = $_POST['Media']['private'];
            if($_POST['Media']['description'])
                $model->description = $_POST['Media']['description'];
            if (! $model->drive) {
                // Handle setting the name if the Media isn't stored on Drive
                $model->name = $_POST['Media']['name'];
                if (empty($model->name))
                    $model->name = $model->fileName;
            }
            if($model->save())
                $this->redirect(array('view', 'id' => $model->id));
        }

        $this->render('update', array(
            'model' => $model,
        ));
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.