* lisp/org/ol.el (org-link-expand-abbrev): Refuse expanding %(...)
link abbrevs that specify unsafe function.  Instead, display a
warning, and do not expand the abbrev.  Clear all the text properties
from the returned link, to avoid any potential vulnerabilities caused
by properties that may contain arbitrary Elisp.

* lisp/org/org.el (org--confirm-resource-safe): When called from
non-file buffer, do not put stray "f" in the prompt.

* lisp/org/org.el (org-file-contents): When loading files, consider all
remote files (like TRAMP-fetched files) unsafe, in addition to URLs.

* lisp/org/org.el (org--latex-preview-when-risky): New variable
controlling how to handle LaTeX previews in Org files from untrusted
origin.
(org-latex-preview): Consult `org--latex-preview-when-risky' before
generating previews.

This patch adds a layer of protection when LaTeX preview is requested
for an email attachment, where `untrusted-content' is set to non-nil.

* lisp/org/org-macro.el (org-macro--set-templates): Get rid of any
risk to evaluate code when `org-macro--set-templates' is called as a
part of major mode initialization.  This way, no code evaluation is
ever triggered when user merely opens the file or when
`mm-display-org-inline' invokes Org major mode to fontify mime part
preview in email messages.

* lisp/org.el (org--confirm-resource-safe): Do not assume that
resource is safe when user replies "n" (do not download).

Reported-by: Max Nikulin <manikulin@gmail.com>
Link: https://orgmode.org/list/upj6uk$b7o$1@ciao.gmane.io

This reverts commit 07a392f445eb21c5e4681027eee9d981300a4309.
It was installed by mistake.

* lisp/org/ox-latex.el (org-latex-src-block-backend)
(org-latex-engraved-theme): Improve docstring; mention that
engrave-faces is a GNU ELPA package.