Added a todo comment about security.

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@15539 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Form/ListBox.py

@@ -3026,6 +3026,8 @@ class ListBoxEditor:
           gv[k] = getattr(request, k, None)
       for url, v in self.update_dict.items():
         v.update(gv)
+        ## XXX security check is needed.
+        ## XXX we need to make restricted version of edit method.
         self.field.restrictedTraverse(url).edit(**v)
 
 allow_class(ListBoxEditor)