Re: [Zope-dev] use of exec in products considered harmful?

On Fri, 10 Mar 2000 15:54:36 -0800, "Jonothan Farr" <jfarr@real.com> wrote:

I'm considering doing something in the LocalFS product that seems like a potentially huge security risk, which is calling exec on a string submitted through a form.

Yeah, thats a big hole.

The reason is that I want to allow users to customize the object class associated with different content-types when the product constructs a Zope object from a local file.

Would something like the Brains class that can be set for SQL methods do the job? Toby Dickenson tdickenson@geminidataloggers.com