[Zope-CMF] Security Question

[seb bacon]

> ...allows you to filter what types show up in the list by adjusting the 'Access
> contents information' permission on the Type Information object.
> 
> It doesn't actually secure invokeFactory but it's good enough for me and I'm
> gonna stick in CVS now...

Are you sure it's a good idea to put something with 
apparent-but-not-real security in a public release - wouldn't it be 
better to come up with something more secure first?  Your thoughts?

seb