Skip to content

Ask before a workbook refresh interval, and keep web queries off local files - #1

Closed
0xtlt wants to merge 1 commit into
mainfrom
harden-web-data-import-2ae7
Closed

0xtlt wants to merge 1 commit into
mainfrom
harden-web-data-import-2ae7

Conversation

@0xtlt

@0xtlt 0xtlt commented Oct 17, 2026

Copy link
Copy Markdown
Owner

A workbook's interval no longer starts the refresh timer by itself. Opening asks once, with the same prompt as refresh-on-open. Declining leaves the timer stopped; Refresh still works. Agreeing, or turning the interval on in Connection Properties, starts it.

Web fetches accept only http and https. file:// and bare paths are rejected with an error. curl is limited to those protocols, including on a redirect (--proto=http,https and --proto-redir=http,https).

Local file import stays a separate, explicit action. Text/CSV connections still re-read the file they name, including on Refresh and, after the same consent, on a timer: that path never goes through the web fetch. JSON, XML and workbook imports the user picks in the file dialog still load and can be refreshed during that session. A web query that arrives inside a workbook cannot read a local path on its own; after the file is opened again, that address is refused until the user picks the file again (Change File Path, or a new import).

Noted from item 1 of https://gist.github.com/TeamDijon/1ea7db06524264dd5b1851aac2642168 (review of 90a5e28).

Open in Web Open in Cursor 

…l files.

A stored interval no longer starts curl on its own, and the web fetch accepts only http and https.

Co-authored-by: Thomas <0xtlt@users.noreply.github.com>
@0xtlt 0xtlt closed this Oct 17, 2026
@cursor
cursor Bot deleted the harden-web-data-import-2ae7 branch October 17, 2026 05:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants