No :-)<br>I just want to run untrusted Python code using exec and I need this code to be allowed to access few methods on few Plone portal tools, but nothing else.<br>For instance:<br>portal_membership.getMemberById(id).getProperty('email')
<br>would be accepted but:<br>portal_membership.addMember()<br>would be forbidden.<br><br>I tried to use zope.security.untrustedpython and also I had a look in zope.tales.expressions to understand how it works but I didn't succeed in understanding how I can define what is authorized and what is forbidden. Apparently it must be done using NamesChecker but I haven't found documentation about it (I tried to copy/paste the unit tests but unsuccessfully...).
<br><br>What would you recommend ? What is the 'official' way to run an untrusted python code with exec and control what this code can do or not ?<br><br>Thanks,<br><br>Eric BREHAULT<br><br><div><span class="gmail_quote">
On 3/15/07, <b class="gmail_sendername">Andreas Jung</b> <<a href="mailto:lists@zopyx.com">lists@zopyx.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br><br>--On 15. März 2007 16:33:56 +0100 Eric Bréhault <<a href="mailto:ebrehault@gmail.com">ebrehault@gmail.com</a>><br>wrote:<br><br>> Hello,<br>><br>> I am trying to build a safe proxy to wrap the Plone portal object in order
<br>> to control what is allowed or not.<br><br>You're trying to reinvent the Zope security machinery?<br><br>-aj<br></blockquote></div><br>