Re: [BUG] Org may fetch remote content without asking user consent

[Ihor Radchenko]

Max Nikulin <manikulin@gmail.com> writes:

> Consider the following .org file:
>
> --- 8< ---
> #+setupfile: /dav:localhost#8000:/msg-123456.org
> --- >8 ---
>
> When Emacs opens it, HTTP server (plain HTTP, not WebDAV is used for 
> test) logs contain
> ...
> Emacs *Messages* buffer:
>
> Tramp: Opening connection for localhost using dav...failed
> ...
> No dialog whether the file should be downloaded is displayed.
>
> My expectation is that Org should not connect to remote servers in 
> default configuration unless it is explicitly approved by the user.

We only protect from files matching `org-url-p'.
TRAMP files are not checked.

I think we can enable checking for anything where `file-remote-p'
returns non-nil.

-- 
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>