    public function setHomePage()
    {
        if ($this->request->is('post')) {
            if (isset($this->request->data['UserSetting'])) {
                $this->request->data = $this->request->data['UserSetting'];
            }
            if (!isset($this->request->data['path'])) {
                $this->request->data = array('path' => $this->request->data);
            }
            if (empty($this->request->data['path'])) {
                throw new InvalidArgumentException(__('No path POSTed.'));
            }
            $setting = array(
                'UserSetting' => array(
                    'user_id' => $this->Auth->user('id'),
                    'setting' => 'homepage',
                    'value' => json_encode(array('path' => $this->request->data['path']))
                )
            );
            $result = $this->UserSetting->setSetting($this->Auth->user(), $setting);
            return $this->RestResponse->saveSuccessResponse('UserSettings', 'setHomePage', false, $this->response->type(), 'Homepage set to ' . $this->request->data['path']);
        } else {
            $this->layout = false;
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.