[Spice-devel] [PATCH spice-gtk] widget: connect automatically webdav channels

[Marc-André Lureau]

Hi

----- Original Message -----
> On 02/06/2015 05:09 PM, Marc-André Lureau wrote:
> > The webdav channel is not being connected by the widget atm.
> >
> > Since it's a quite desirable thing to have, instead of pushing a
> > spice_channel_connect() in many clients (boxes, virt-viewer,
> > virt-manager, vinagre etc), let the widget do it automatically.
> 
> Clients connecting to untrusted VMs may not want the VM to have access
> to the host filesystem.  Previously they were safe if they did nothing,
> but with this change, they would need to explicitly set shared-dir to
> NULL.  (Which, of course, will cause a warning with previous versions of
> spice-gtk.)

Well, the shared directory is the ~/Public by default, so I assume
this is fine. Although PhoDAV could have security bugs (
the trivial '..' in the path should be okay iirc)

I think we should still enable it by default, but it's good that you
remind of the implication. Hopefully people read release notes...