[chrisclark]

Summary

Stops a shared query link from executing SQL in the visitor's session. High.

QueryView.get ran the query on a plain page view whenever show was truthy, which it is by default:

show = url_get_show(request)          # defaults to 1
params = query.available_params()
if not EXPLORER_AUTORUN_QUERY_WITH_PARAMS and params:
    show = False

Parameters in the URL (?params=id:5) are documented as the way to share a parameterized query, so a link carries the values that make it run. Opening such a link executed the query immediately, in the session of whoever clicked it, with no Save & Run and no review of the parameters.

Correction to my earlier report: I initially listed "?show=1 overrides EXPLORER_AUTORUN_QUERY_WITH_PARAMS=False" as part of this. On re-testing that is not true — the setting does suppress the run, and I had validated it badly the first time. It is corrected here rather than left in the history. The real issue is narrower: with the setting left at its default (True), a URL-parameterized link always runs.

Fix

Parameterized queries loaded from the URL now render without executing — the same behaviour EXPLORER_AUTORUN_QUERY_WITH_PARAMS=False already gives, applied to the case where the parameters did not come from the person viewing. The setting keeps its documented meaning, and queries with no URL parameters still autorun as before.

This complements #723. Binding parameter values means a parameter can no longer change the SQL; this removes the remaining case where merely opening a shared link runs a query the visitor never asked for.

Nothing is lost: the detail page renders the parameter values on request, so the user clicks Save & Run to get results.

Tests

• URL params do not autorun on a plain page view;
• same with EXPLORER_AUTORUN_QUERY_WITH_PARAMS=True explicitly set (the actual default path);
• a query with no URL parameters still autoruns, so the documented behaviour is unchanged.

Docs updated in install.rst next to the EXPLORER_AUTORUN_QUERY_WITH_PARAMS entry.

Full suite: 297 tests, OK. ruff check explorer/: clean.