function MAX_displayAcls($acls, $aParams)
{
    $tabindex =& $GLOBALS['tabindex'];
    $page = basename($_SERVER['SCRIPT_NAME']);
    $conf = $GLOBALS['_MAX']['CONF'];

    echo "<form action='{$page}' method='post'>";
    echo "<input type='hidden' name='token' value='".urlencode(phpAds_SessionGetToken())."' />";

    echo "<label><img src='" . OX::assetPath() . "/images/icon-acl-add.gif' align='absmiddle'>&nbsp;". $GLOBALS['strACLAdd'] .": &nbsp;";
    echo "<select name='type' accesskey='{$GLOBALS['keyAddNew']}' tabindex='".($tabindex++)."'>";
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.