`allow_url_fopen` is IMO acceptable because it is going to be running on a server that is controlled by zikula. This module is not intended for widespread use. While it **is** open source, it will not be run on varied websites probably. It will only be run in one place. So, I don't see this as a problem.