JSONFormField should absolutely not be eval-ing user-supplied content.

[Fletcher Tomalty]

Think hiding __builtins__ helps? Nope.

(x for x in (1).__class__.__base__.__subclasses__() if x.__name__ == 'catch_warnings').next()()._module.__builtins__

[Derek Schaefer]

Good point, that should certainly be disabled by default. Will commit shortly.