[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/AccessControl - ZopeGuards.py:1.13

[Chris Withers]

(sorry for moving this back to the list, but this is good stuff...)

Shane Hathaway wrote:
> I'm under the gun and there may be a Zope release before I have a chance 
> to look at it. 

And I would REALLY like to see this problem fixed before yet another Zope 
release goes by. I raised this almost a month ago and haven't even had any ideas 
from anyone :-(

<snip examples>
> There needs to be something that declares that a module is allowed to be 
> imported, otherwise Zope opens up large unknowns.

Well indeed. BUT, how is a module supposed to say it's allowed to be imported?
Answer: it makes security declarations.

How does Zope find these declarations?
Answer: by importing the module.

What does Zope do if it fails to find the declaration?
Answer: fail to import the module.

This chicken and egg is very frustrating for users and package developers alike.

> Tres and I had a short discussion about this and we had some ideas, such 
> as declaring that anything under Products (or a specific product) is 
> fair game.  We'll work on that later.

Well, that's the case already, since 'Products' already imports all its sub 
packages as part of Zope startup.

Now, unless this can be fixed, the documentation for Python Scripts really 
should be updated to say "you can only use Zope products within untrusted python 
code code" since that's effectively the case.

I guess I'll just have to re-release Strip-O-Gram explaining that if (and only 
if) you want to use it with Zope, you have to put it in the Products directory, 
change all your import statements so they have 'Products.' at the front, and 
sacrifice a couple of goats.

cheers,

Chris