Fix: Do not import pavement

pyproject.toml

@@ -34,7 +34,7 @@ license = "GPL"
 name = "runestone"
 readme = "README.rst"
 repository = "https://github.com/RunestoneInteractive/RunestoneComponents"
-version = "6.3.8"
+version = "6.3.9"
 
 # See https://python-poetry.org/docs/pyproject/#include-and-exclude.
 include = [

runestone/server/utils.py

@@ -41,13 +41,10 @@ def _build_runestone_book(course, click=click):
     """
     try:
         if os.path.exists("pavement.py"):
-            sys.path.insert(0, os.getcwd())
             # Since this may be used in a long running process (see AuthorServer/worker)
-            # we need to re-import to get the right values
-            if "pavement" in globals():
-                importlib.reload(pavement)
-            else:
-                import pavement
+            # using import is a bad idea, exec can be dangerous as well
+            paver_vars = {}
+            exec(open("pavement.py").read(), paver_vars)
         else:
             click.echo(
                 "I can't find a pavement.py file in {} you need that to build".format(
@@ -60,10 +57,10 @@ def _build_runestone_book(course, click=click):
         print(e)
         return False
 
-    if pavement.project_name != course:
+    if paver_vars["project_name"] != course:
         click.echo(
             "Error: {} and {} do not match.  Your course name needs to match the project_name in pavement.py".format(
-                course, pavement.project_name
+                course, paver_vars["project_name"]
             )
         )
         return False
@@ -80,7 +77,7 @@ def _build_runestone_book(course, click=click):
         )
         return False
     click.echo("Build succeedeed... Now deploying to published")
-    if pavement.dest != "./published":
+    if paver_vars["dest"] != "./published":
         click.echo(
             "Incorrect deployment directory.  dest should be ./published in pavement.py"
         )