* lisp/progmodes/python.el (run-python): Explain why we remove the current

directory from sys.path.  Suggested by Eric Hanchrow <erich@cozi.com>.

lisp/ChangeLog

 2010-11-17  Stefan Monnier  <monnier@iro.umontreal.ca>
+	* progmodes/python.el (run-python): Explain why we remove the current
+	directory from sys.path.  Suggested by Eric Hanchrow <erich@cozi.com>.
+
 	* progmodes/grep.el (grep-regexp-alist): Tighten the regexp (bug#7378).
 2010-11-16  Stefan Monnier  <monnier@iro.umontreal.ca>

lisp/progmodes/python.el

@@ -1586,6 +1586,11 @@ buffer for a list of commands.)"
     (with-current-buffer
 	(let* ((cmdlist
 		(append (python-args-to-list cmd)
+                        ;; It's easy for the user to cause the process to be
+			;; started without realizing it (e.g. to perform
+			;; completion); for this reason loading files from the
+			;; current directory is a security risk.  See
+			;; http://article.gmane.org/gmane.emacs.devel/103569
 			'("-i" "-c" "import sys; sys.path.remove('')")))
 	       (path (getenv "PYTHONPATH"))
 	       (process-environment	; to import emacs.py