Access clear method of acl_users.data

[n1k9]

When you try to access /acl_users/data/clear via HTTP without any privileges, collections.UserDict.clear() method is started.
This deletes all users in User Folder.

I tried to change User Folder security, but I did not change cleaning effect.

It seems that we have no restrictions on the access to the UserFolder.data attribute (PersistentMapping -> UserDict)

There are any activities to prevent this?

[dataflake]

This is fixed in AccessControl version 7.2 and Zope 5.11.1.