   static function dropdownConnect($itemtype, $fromtype, $myname, $entity_restrict = -1,
                                   $onlyglobal = 0, $used = []) {
      global $CFG_GLPI;

      $rand     = mt_rand();

      $field_id = Html::cleanId("dropdown_".$myname.$rand);
      $param    = [
         'entity_restrict' => $entity_restrict,
         'fromtype'        => $fromtype,
         'itemtype'        => $itemtype,
         'onlyglobal'      => $onlyglobal,
         'used'            => $used,
         '_idor_token'     => Session::getNewIDORToken($itemtype),
      ];

      echo Html::jsAjaxDropdown($myname, $field_id,
                                $CFG_GLPI['root_doc']."/ajax/getDropdownConnect.php",
                                $param);

      return $rand;
   }
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.