Re: [Jython-dev] co_names

[Kevin D. <kda...@we...>]

> > Zope places some security restrictions on the code that is submitted
through
> > a web browser. Any method or variable that is not meant to be accessed
by
> > someone doing through the web development starts with an "_". So, they
use
> > co_names in a number of places to look for variable/method references
that
> > begin with "_".
> >
> > This is the mechanism that prevents people from being able to alter
their
> > own security characteristics or access arbitrary Zope objects.
> >
> I see, yes that way can work in jython too, if you have control
> over compilation of code, ot the other hand the possible access to Java
> code enters in the equation(?)

We'll definitely have to look at other security implications that come up as
a result of using Java/Jython.

I believe that Zope restricts which modules may be imported by
through-the-web code. If that's the case, we can restrict access to the
Jython Java classes so that people can't circumvent the Jython-level
security used by Zope.

Kevin