	public function jsonError(Exception $exception,
							  IRequest $request,
							  ILogger $logger) {
		$code = $this->getHttpStatusCode($exception);

		// If the exception is not of type ForbiddenServiceException only show a
		// generic error message to avoid leaking information.
		if(!($exception instanceof ForbiddenServiceException)) {
			$logger->logException($exception, ['app' => 'gallery']);
			$message = sprintf('An error occurred. Request ID: %s', $request->getId());
		} else {
			$message = $exception->getMessage() . ' (' . $code . ')';
		}

		return new JSONResponse(
			[
				'message' => $message,
				'success' => false,
			],
			$code
		);
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.