      synchronize: function(requisition, errorHandler) {
        /**
        * @param {object} requisition The requisition object
        * @param {string} rescanExisting true to perform a full scan, false to only add/remove nodes without scan, dbonly for all DB operations without scan
        */
        var doSynchronize = function(requisition, rescanExisting) {
          RequisitionsService.startTiming();
          RequisitionsService.synchronizeRequisition(requisition.foreignSource, rescanExisting).then(
            function() { // success
              growl.success('The import operation has been started for ' + _.escape(requisition.foreignSource) + ' (rescanExisting? ' + rescanExisting + ')<br/>Use <b>refresh</b> to update the deployed statistics');
              requisition.setDeployed(true);
            },
            errorHandler
          );
        };
        bootbox.prompt({
            title: 'Synchronize Requisition  ' +  _.escape(requisition.foreignSource),
            message: '<p><b>Choose a scan option: </b></p>',
            inputType: 'radio',
            inputOptions: [
            {
                text: 'Scan all nodes',
                value: 'true',
            },
            {
                text: 'Scan added nodes only',
                value: 'false',
            },
            {
                text: 'No scanning',
                value: 'dbonly',
            }
            ],
            buttons: {
                    confirm: {
                        label: 'Synchronize',
                    },
                    cancel: {
                        label: 'Cancel',
                    }
                },
            swapButtonOrder: 'true',
            callback: function (result) {
                if (result !== null) {
                    doSynchronize(requisition, result);
                }
            }
        });
      }
    };
  }]);
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.