Blocks

I needed the ability to run my own php code inside a block. so far my get_content methode saves the code to a temp file and executes it via include and output buffering:

$tempfile = $CFG->dataroot.'/temp/php_'.session_id().'.php';
$fp = fopen($tempfile, 'w');
fwrite($fp, $this->config->text);
fclose($fp);
ob_start();
include($tempfile);
$this->config->text = ob_get_contents();
ob_end_clean();
unlink($tempfile);

this block is a real security risk. so my idea was, to only allow administrators to edit it. but I'm not sure how I should do that (i'm using moodle 1.9 from CVS):
should I use a new role-permission for that? is there a way to hide a block from the addnewblock-dropdownmenu? how can I remove the edit-icon without removing the config_instance.html file?

thanks