On Tuesday 20 October 2009 15:07:03 Klaus Kaempf wrote:
* Martin Kudlvasr
[Oct 20. 2009 15:03]: On Tuesday 20 October 2009 10:22:42 Stefan Schubert wrote:
Hi, I have had the same problem, so I checked in the fix meanwhile. The general question has raised if the EULA acceptance is really needed on service side while every other service REST call? Isn't enough to check the EULA in the installation workflow only?
Yes, it is enough, BUT there is no installation workflow on the service side. Webservice can be asked just to mark basesystem as finished (without processing its workflow). And this basesystem-finished flag is never checked on backend. It is only checked in UI (controlpanel).
Which is completely fine from my pov.
If someone has enough knowledge to bypass the WebYaST UI, we can't stop him anyways ;-)
This is news to me. Until now I though, that webservice should be usable (and secure) on its own. Including accepting eulas and telling the user, that he has to accept eulas first. This is not about bypassing security, this is about telling the user, that there is an eula to accept, even if he is using only command-line. If we leave eulas only in UI and basesystem, some users (in some completely valid use-cases) simply won't realize there is an eula to accept. When user skips basesystem setup, it is his problem. When the user does not accept eula, it's license violation (also 3rd party vendors may have problem with that). I don't know, maybe it is just me seeing this problem as too serious. From the performance POV ... the check for detecting, if eula was accepted, has 1-2 file touches. I don't see it as speed bottleneck (in comparison to dbus call for instance). I understand that this decision is for the project managers to make, so I'll change the implementation to whatever the decision is going to be. The amount of work needed is minimal. Cheers, Martin
Klaus --- SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nürnberg)
-- To unsubscribe, e-mail: yast-devel+unsubscribe@opensuse.org For additional commands, e-mail: yast-devel+help@opensuse.org