[Zope] Print error_traceback from script (python)

[Tim Hicks]

> Tim Hicks writes:
>  > I have a script (python) that has various try/except clauses in it.  I
would
>  > like to be able to get hold of the traceback from within the except
block so
>  > that I can (optionally) send it as an argument to a user-friendly page
>  > summarising how the last lot of transactions went.
> The "README" tab in the PythonScripts product description
> (of, if you prefer, the corresponding file in "Products/PythonScripts")
> tells you how to make modules and functions available in
> PythonScripts (i.e. lose security restrictions).
>
> To print the traceback, you need "sys.exc_info" and functions
> from the traceback module (e.g. "print_exception"). Look
> at the Python documentation, for details.

Further to Dieter's advice, I have created a 'customImports' product with
the following __init__.py script:

---Begin __init__.py---
from Products.PythonScripts.Utility import allow_module, allow_class
from AccessControl import ModuleSecurityInfo, ClassSecurityInfo
from Globals import InitializeClass

allow_module('traceback')

ModuleSecurityInfo('sys').declarePublic('exc_info')
---End __init__.py---

This has allowd me to get hold of the traceback and exception/error
information that I was after.  I am just wondering if I've left myself open
to security issues by allowing these modules/part-modules in my python
scripts.  I read that 'sys' is a particular worry, so is there anything bad
that can happen by allowing 'exc_info'?  And what about allowing the
'traceback' module?

cheers

tim

ps Here is how I use the modules in my script (python).  Does this look
appropriate? (N.B. aaatest is a ZSQL method)

---Begin script---
from sys import exc_info
import traceback

try:
  context.aaatest()
except:
  print context.standard_html_header(context, context.REQUEST)

  tuple = exc_info()
  print '<h3>%s</h3>' % tuple[0]
  print '<h3>%s</h3>' % str(tuple[1])
  print traceback.extract_tb(tuple[2])

  print context.standard_html_footer(context, context.REQUEST)

return printed
---End script---