mirror of
https://github.com/gohugoio/hugo.git
synced 2024-09-13 01:12:31 -04:00
Squashed 'docs/' changes from 4eb10c1a9..b8b20e9a2
b8b20e9a2 Update index.md f33994fe6 Remove files.Extension (duplicate of files.Ext) 948d6d69d layouts: Use .File.Path d3050b78c Document .Page.BundleType (#1620) 8a033918f Image filters: ensure Grayscale is a level-2 heading 98537018f Document .Publish method for global resources 963ddc994 docs: add a link to the mailmap documentation 915f858dc Fix release notes version 58093dafe Update index.md 8008ba1e1 Release 0.91.2 d1788dae8 Merge branch 'tempv0.91.2' af2970180 Revert "config/security: Add HOME to default exec env var whitelist" 2648d3088 netlify: Hugo 0.91.1 d0801599c Merge branch 'tempv0.91.1' b343bfd7a config/security: Add HOME to default exec env var whitelist 03fbb403f Update data-templates.md 2f608055f Correct GetRemote docs and examples 4e942166a Update 2021-12-17-no-more-releasenotes.md dbf9514fd Update security.toml 2c38aa356 Update index.md 562ad8e96 Add timeZone 4bc482152 Update introduction.md 1eb66c758 news: Add a note about the placement of release notes b2a293abb Remove the default archetype template f9837793c netlify: Hugo 0.91.0 467256ad5 docs: Regen docs helper 68554cf77 Add some basic security policies with sensible defaults git-subtree-dir: docs git-subtree-split: b8b20e9a257dca8e53ca9e5f314cf54b18702a37
This commit is contained in:
Bjørn Erik Pedersen
parent
45e6fdb315
commit
a8e9fc699a
19 changed files with 172 additions and 44 deletions
|
|
@ -1,12 +0,0 @@
|
|||
---
|
||||
linktitle: ""
|
||||
description: ""
|
||||
publishdate: ""
|
||||
lastmod: ""
|
||||
categories: []
|
||||
tags: []
|
||||
weight: 00
|
||||
slug: ""
|
||||
aliases: []
|
||||
toc: false
|
||||
---
|
||||
6
archetypes/news/index.md
Normal file
6
archetypes/news/index.md
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
---
|
||||
title: "{{ replace .Name "-" " " | title }}"
|
||||
description: ""
|
||||
date: {{ .Date }}
|
||||
---
|
||||
|
||||
|
|
@ -2,6 +2,7 @@ baseURL = "https://gohugo.io/"
|
|||
paginate = 100
|
||||
defaultContentLanguage = "en"
|
||||
enableEmoji = true
|
||||
timeZone = "Europe/Oslo"
|
||||
# Set the unicode character used for the "return" link in page footnotes.
|
||||
footnotereturnlinkcontents = "↩"
|
||||
languageCode = "en-us"
|
||||
|
|
|
|||
13
config/_default/security.toml
Normal file
13
config/_default/security.toml
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
|
||||
enableInlineShortcodes = false
|
||||
|
||||
[exec]
|
||||
allow = ['^go$']
|
||||
osEnv = ['^PATH$']
|
||||
|
||||
[funcs]
|
||||
getenv = ['^HUGO_', '^REPOSITORY_URL$', '^BRANCH$']
|
||||
|
||||
[http]
|
||||
methods = ['(?i)GET|POST']
|
||||
urls = ['.*']
|
||||
|
|
@ -21,14 +21,29 @@ Hugo produces static output, so once built, the runtime is the browser (assuming
|
|||
|
||||
But when developing and building your site, the runtime is the `hugo` executable. Securing a runtime can be [a real challenge](https://blog.logrocket.com/how-to-protect-your-node-js-applications-from-malicious-dependencies-5f2e60ea08f9/).
|
||||
|
||||
**Hugo's main approach is that of sandboxing:**
|
||||
**Hugo's main approach is that of sandboxing and a security policy with strict defaults:**
|
||||
|
||||
* Hugo has a virtual file system and only the main project (not third-party components) is allowed to mount directories or files outside the project root.
|
||||
* Only the main project can walk symbolic links.
|
||||
* User-defined components have only read-access to the filesystem.
|
||||
* We shell out to some external binaries to support [Asciidoctor](/content-management/formats/#list-of-content-formats) and similar, but those binaries and their flags are predefined. General functions to run arbitrary external OS commands have been [discussed](https://github.com/gohugoio/hugo/issues/796), but not implemented because of security concerns.
|
||||
* We shell out to some external binaries to support [Asciidoctor](/content-management/formats/#list-of-content-formats) and similar, but those binaries and their flags are predefined and disabled by default (see [Security Policy](#security-policy)). General functions to run arbitrary external OS commands have been [discussed](https://github.com/gohugoio/hugo/issues/796), but not implemented because of security concerns.
|
||||
|
||||
Hugo will soon introduce a concept of _Content Source Plugins_ (AKA _Pages from Data_), but the above will still hold true.
|
||||
|
||||
## Security Policy
|
||||
|
||||
{{< new-in "0.91.0" >}}
|
||||
|
||||
Hugo has a built-in security policy that restricts access to [os/exec](https://pkg.go.dev/os/exec), remote communication and similar.
|
||||
|
||||
The default configuration is listed below. And build using features not whitelisted in the security policy will faill with a detailed message about what needs to be done. Most of these settings are whitelists (string or slice, [Regular Expressions](https://pkg.go.dev/regexp) or `none` which matches nothing).
|
||||
|
||||
{{< code-toggle config="security" />}}
|
||||
|
||||
Note that these and other config settings in Hugo can be overridden by the OS environment. If you want to block all remote HTTP fetching of data:
|
||||
|
||||
```
|
||||
HUGO_SECURITY_HTTP_URLS=none hugo
|
||||
```
|
||||
|
||||
## Dependency Security
|
||||
|
||||
|
|
|
|||
|
|
@ -305,7 +305,7 @@ bgColor = "#ffffff"
|
|||
# disk space reasons more than anything.
|
||||
# If you want it all, put ".*" in this config setting.
|
||||
# Note that if neither this or ExcludeFields is set, Hugo will return a small
|
||||
# default set.
|
||||
# default set: GPS|Exif|Exposure[M|P|B]|Contrast|Resolution|Sharp|JPEG|Metering|Sensing|Saturation|ColorSpace|Flash|WhiteBalance
|
||||
includeFields = ""
|
||||
|
||||
# Regexp matching the Exif fields you want to exclude. This may be easier to use
|
||||
|
|
|
|||
|
|
@ -128,7 +128,7 @@ images.GaussianBlur SIGMA
|
|||
|
||||
GaussianBlur creates a filter that applies a gaussian blur to an image.
|
||||
|
||||
### Grayscale
|
||||
## Grayscale
|
||||
|
||||
{{% funcsig %}}
|
||||
images.Grayscale
|
||||
|
|
|
|||
|
|
@ -381,6 +381,10 @@ Maximum number of items in the RSS feed.
|
|||
### sectionPagesMenu
|
||||
See ["Section Menu for Lazy Bloggers"](/templates/menu-templates/#section-menu-for-lazy-bloggers).
|
||||
|
||||
### security
|
||||
|
||||
See [Security Policy](/about/security-model/#security-policy)
|
||||
|
||||
### sitemap
|
||||
Default [sitemap configuration](/templates/sitemap-template/#configure-sitemapxml).
|
||||
|
||||
|
|
|
|||
|
|
@ -18,25 +18,32 @@ toc: true
|
|||
aliases: [/assets/]
|
||||
---
|
||||
|
||||
## Get Resource with resources.Get
|
||||
## Get Resource with resources.Get and resources.GetRemote
|
||||
|
||||
In order to process an asset with Hugo Pipes, it must be retrieved as a `Resource` using `resources.Get`. The first argument can be either a local the path to file relative to the `asset` directory/directories or a remote URL.
|
||||
In order to process an asset with Hugo Pipes, it must be retrieved as a `Resource` using `resources.Get` or `resources.GetRemote`.
|
||||
|
||||
With `resources.Get`, the first argument is a local path relative to the `assets` directory/directories:
|
||||
|
||||
```go-html-template
|
||||
{{ $local := resources.Get "sass/main.scss" }}
|
||||
{{ $remote := resources.Get "https://www.example.com/styles.scss" }}
|
||||
```
|
||||
|
||||
`resources.Get` will always return `nil` if the resource could not be found.
|
||||
With `resources.GetRemote`, the first argument is a remote URL:
|
||||
|
||||
```go-html-template
|
||||
{{ $remote := resources.GetRemote "https://www.example.com/styles.scss" }}
|
||||
```
|
||||
|
||||
`resources.Get` and `resources.GetRemote` return `nil` if the resource is not found.
|
||||
|
||||
### Error Handling
|
||||
|
||||
{{< new-in "0.90.1" >}}
|
||||
{{< new-in "0.91.0" >}}
|
||||
|
||||
The return value from `resources.Get` includes an `.Err` method that will return an error if the call failed. If you want to just log any error as a `WARNING` you can use a construct similar to the one below.
|
||||
The return value from `resources.GetRemote` includes an `.Err` method that will return an error if the call failed. If you want to just log any error as a `WARNING` you can use a construct similar to the one below.
|
||||
|
||||
```go-html-template
|
||||
{{ with resources.Get "https://gohugo.io/images/gohugoio-card-1.png" }}
|
||||
{{ with resources.GetRemote "https://gohugo.io/images/gohugoio-card-1.png" }}
|
||||
{{ with .Err }}
|
||||
{{ warnf "%s" . }}
|
||||
{{ else }}
|
||||
|
|
@ -49,22 +56,22 @@ Note that if you do not handle `.Err` yourself, Hugo will fail the build the fir
|
|||
|
||||
### Remote Options
|
||||
|
||||
When fetching a remote `Resource`, `resources.Get` takes an optional options map as the last argument, e.g.:
|
||||
When fetching a remote `Resource`, `resources.GetRemote` takes an optional options map as the last argument, e.g.:
|
||||
|
||||
```go-html-template
|
||||
{{ $resource := resources.Get "https://example.org/api" (dict "headers" (dict "Authorization" "Bearer abcd")) }}
|
||||
{{ $resource := resources.GetRemote "https://example.org/api" (dict "headers" (dict "Authorization" "Bearer abcd")) }}
|
||||
```
|
||||
|
||||
If you need multiple values for the same header key, use a slice:
|
||||
|
||||
```go-html-template
|
||||
{{ $resource := resources.Get "https://example.org/api" (dict "headers" (dict "X-List" (slice "a" "b" "c"))) }}
|
||||
{{ $resource := resources.GetRemote "https://example.org/api" (dict "headers" (dict "X-List" (slice "a" "b" "c"))) }}
|
||||
```
|
||||
|
||||
You can also change the request method and set the request body:
|
||||
|
||||
```go-html-template
|
||||
{{ $postResponse := resources.Get "https://example.org/api" (dict
|
||||
{{ $postResponse := resources.GetRemote "https://example.org/api" (dict
|
||||
"method" "post"
|
||||
"body" `{"complete": true}`
|
||||
"headers" (dict
|
||||
|
|
@ -75,16 +82,15 @@ You can also change the request method and set the request body:
|
|||
|
||||
### Caching of Remote Resources
|
||||
|
||||
Remote resources fetched with `resources.Get` will be cached on disk. See [Configure File Caches](/getting-started/configuration/#configure-file-caches) for details.
|
||||
Remote resources fetched with `resources.GetRemote` will be cached on disk. See [Configure File Caches](/getting-started/configuration/#configure-file-caches) for details.
|
||||
|
||||
## Asset directory
|
||||
|
||||
Asset files must be stored in the asset directory. This is `/assets` by default, but can be configured via the configuration file's `assetDir` key.
|
||||
|
||||
|
||||
### Asset Publishing
|
||||
|
||||
Assets will only be published (to `/public`) if `.Permalink` or `.RelPermalink` is used. You can use `.Content` to inline the asset.
|
||||
Hugo publishes assets to the to the `publishDir` (typically `public`) when you invoke `.Permalink`, `.RelPermalink`, or `.Publish`. You can use `.Content` to inline the asset.
|
||||
|
||||
## Go Pipes
|
||||
|
||||
|
|
|
|||
10
content/en/news/2021-12-17-no-more-releasenotes.md
Normal file
10
content/en/news/2021-12-17-no-more-releasenotes.md
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
title: "Release Notes now on GitHub Only"
|
||||
date: 2021-12-17T12:22:47+01:00
|
||||
slug: "no-more-releasenotes-here"
|
||||
description: "Hugo Release Notes now gets released on GitHub Only"
|
||||
|
||||
---
|
||||
|
||||
For details about release notes, you need to go here: https://github.com/gohugoio/hugo/releases -- see this for an Atom feed: https://github.com/gohugoio/hugo/releases.atom
|
||||
|
||||
BIN
content/en/news/2021/0.91.2-relnotes/featured.png
Normal file
BIN
content/en/news/2021/0.91.2-relnotes/featured.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 128 KiB |
9
content/en/news/2021/0.91.2-relnotes/index.md
Normal file
9
content/en/news/2021/0.91.2-relnotes/index.md
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
title: "Fixes the “Stuck on Build” Bug"
|
||||
description: "Hugo 0.91.2 is the last release before Christmas!"
|
||||
date: 2021-12-23T17:47:41+01:00
|
||||
---
|
||||
|
||||
Read the full change log on [GitHub](https://github.com/gohugoio/hugo/releases/tag/v0.91.2).
|
||||
|
||||
**Merry Christmas to all of you!**
|
||||
|
|
@ -53,8 +53,8 @@ The example below is a bit contrived, but it illustrates the flexibility of data
|
|||
|
||||
{{< code-toggle file="jacopastorius" >}}
|
||||
discography = [
|
||||
"1974 – Modern American Music … Period! The Criteria Sessions",
|
||||
"1974 – Jaco",
|
||||
"1974 - Modern American Music … Period! The Criteria Sessions",
|
||||
"1974 - Jaco",
|
||||
"1976 - Jaco Pastorius",
|
||||
"1981 - Word of Mouth",
|
||||
"1981 - The Birthday Concert (released in 1995)",
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ The `.File` object contains the following fields:
|
|||
: the filename without extension (e.g., `foo.en`)
|
||||
|
||||
.File.Ext
|
||||
: the file extension of the content file (e.g., `md`); this can also be called using `.File.Extension` as well. Note that it is *only* the extension without `.`.
|
||||
: the file extension of the content file (e.g., `md`).
|
||||
|
||||
.File.Lang
|
||||
: the language associated with the given file if Hugo's [Multilingual features][multilingual] are enabled (e.g., `en`)
|
||||
|
|
|
|||
|
|
@ -37,10 +37,10 @@ The `GitInfo` object contains the following fields:
|
|||
: the abbreviated commit hash (e.g., `866cbcc`)
|
||||
|
||||
.AuthorName
|
||||
: the author's name, respecting `.mailmap`
|
||||
: the author's name, respecting [`.mailmap`](https://git-scm.com/docs/gitmailmap)
|
||||
|
||||
.AuthorEmail
|
||||
: the author's email address, respecting `.mailmap`
|
||||
: the author's email address, respecting [`.mailmap`](https://git-scm.com/docs/gitmailmap)
|
||||
|
||||
.AuthorDate
|
||||
: the author date
|
||||
|
|
|
|||
|
|
@ -33,6 +33,9 @@ See [`.Scratch`](/functions/scratch/) for page-scoped, writable variables.
|
|||
.Aliases
|
||||
: aliases of this page
|
||||
|
||||
.BundleType
|
||||
: the [bundle] type: `leaf`, `branch`, or an empty string if the page is not a bundle.
|
||||
|
||||
.Content
|
||||
: the content itself, defined below the front matter.
|
||||
|
||||
|
|
@ -305,3 +308,4 @@ The top-level key will be preferred. Therefore, the following method, when appli
|
|||
|
||||
[gitinfo]: /variables/git/
|
||||
[File Variables]: /variables/files/
|
||||
[bundle]: {{< relref "content-management/page-bundles" >}}
|
||||
|
|
|
|||
|
|
@ -1775,9 +1775,15 @@
|
|||
"permalinks": {
|
||||
"_merge": "none"
|
||||
},
|
||||
"privacy": {
|
||||
"_merge": "none"
|
||||
},
|
||||
"related": {
|
||||
"_merge": "none"
|
||||
},
|
||||
"security": {
|
||||
"_merge": "none"
|
||||
},
|
||||
"sitemap": {
|
||||
"_merge": "none"
|
||||
},
|
||||
|
|
@ -1822,6 +1828,33 @@
|
|||
"keepWhitespace": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"security": {
|
||||
"enableInlineShortcodes": false,
|
||||
"exec": {
|
||||
"allow": [
|
||||
"^dart-sass-embedded$",
|
||||
"^go$",
|
||||
"^npx$",
|
||||
"^postcss$"
|
||||
],
|
||||
"osEnv": [
|
||||
"(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$"
|
||||
]
|
||||
},
|
||||
"funcs": {
|
||||
"getenv": [
|
||||
"^HUGO_"
|
||||
]
|
||||
},
|
||||
"http": {
|
||||
"methods": [
|
||||
"(?i)GET|POST"
|
||||
],
|
||||
"urls": [
|
||||
".*"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"media": {
|
||||
|
|
@ -1954,6 +1987,34 @@
|
|||
"yml"
|
||||
]
|
||||
},
|
||||
{
|
||||
"mainType": "font",
|
||||
"subType": "otf",
|
||||
"delimiter": ".",
|
||||
"firstSuffix": {
|
||||
"suffix": "otf",
|
||||
"fullSuffix": ".otf"
|
||||
},
|
||||
"type": "font/otf",
|
||||
"string": "font/otf",
|
||||
"suffixes": [
|
||||
"otf"
|
||||
]
|
||||
},
|
||||
{
|
||||
"mainType": "font",
|
||||
"subType": "ttf",
|
||||
"delimiter": ".",
|
||||
"firstSuffix": {
|
||||
"suffix": "ttf",
|
||||
"fullSuffix": ".ttf"
|
||||
},
|
||||
"type": "font/ttf",
|
||||
"string": "font/ttf",
|
||||
"suffixes": [
|
||||
"ttf"
|
||||
]
|
||||
},
|
||||
{
|
||||
"mainType": "image",
|
||||
"subType": "jpeg",
|
||||
|
|
@ -1966,7 +2027,10 @@
|
|||
"string": "image/jpeg",
|
||||
"suffixes": [
|
||||
"jpg",
|
||||
"jpeg"
|
||||
"jpeg",
|
||||
"jpe",
|
||||
"jif",
|
||||
"jfif"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
|
@ -4524,9 +4588,9 @@
|
|||
"Examples": null
|
||||
},
|
||||
"Get": {
|
||||
"Description": "Get locates the filename given in Hugo's assets filesystem or downloads\na file from an URL and creates a Resource object that can be used for\nfurther transformations.\n\nFor URLs an additional argument with options can be provided.",
|
||||
"Description": "Get locates the filename given in Hugo's assets filesystem and\ncreates a Resource object that can be used for\nfurther transformations.",
|
||||
"Args": [
|
||||
"args"
|
||||
"filename"
|
||||
],
|
||||
"Aliases": null,
|
||||
"Examples": []
|
||||
|
|
@ -4537,6 +4601,14 @@
|
|||
"Aliases": null,
|
||||
"Examples": null
|
||||
},
|
||||
"GetRemote": {
|
||||
"Description": "GetRemote gets the URL (via HTTP(s)) in the first argument in args and creates Resource object that can be used for\nfurther transformations.\n\nA second argument may be provided with an option map.\n\nNote: This method does not return any error as a second argument,\nfor any error situations the error can be checked in .Err.",
|
||||
"Args": [
|
||||
"args"
|
||||
],
|
||||
"Aliases": null,
|
||||
"Examples": []
|
||||
},
|
||||
"Match": {
|
||||
"Description": "",
|
||||
"Args": null,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
<a href="{{ .Permalink }}">{{ .Title }}</a>
|
||||
</td>
|
||||
<td class="pv2 ph3">
|
||||
<a href="{{.Site.Params.ghrepo}}blob/master/content/{{.Lang }}/{{.Path}}">
|
||||
<a href="{{.Site.Params.ghrepo}}blob/master/content/{{.Lang }}/{{.File.Path}}">
|
||||
{{ with .GitInfo }}{{ .Subject }}{{ else }}Source{{ end }}
|
||||
</a>
|
||||
</td>
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ publish = "public"
|
|||
command = "hugo --gc --minify"
|
||||
|
||||
[context.production.environment]
|
||||
HUGO_VERSION = "0.90.1"
|
||||
HUGO_VERSION = "0.91.2"
|
||||
HUGO_ENV = "production"
|
||||
HUGO_ENABLEGITINFO = "true"
|
||||
|
||||
|
|
@ -11,20 +11,20 @@ HUGO_ENABLEGITINFO = "true"
|
|||
command = "hugo --gc --minify --enableGitInfo"
|
||||
|
||||
[context.split1.environment]
|
||||
HUGO_VERSION = "0.90.1"
|
||||
HUGO_VERSION = "0.91.2"
|
||||
HUGO_ENV = "production"
|
||||
|
||||
[context.deploy-preview]
|
||||
command = "hugo --gc --minify --buildFuture -b $DEPLOY_PRIME_URL"
|
||||
|
||||
[context.deploy-preview.environment]
|
||||
HUGO_VERSION = "0.90.1"
|
||||
HUGO_VERSION = "0.91.2"
|
||||
|
||||
[context.branch-deploy]
|
||||
command = "hugo --gc --minify -b $DEPLOY_PRIME_URL"
|
||||
|
||||
[context.branch-deploy.environment]
|
||||
HUGO_VERSION = "0.90.1"
|
||||
HUGO_VERSION = "0.91.2"
|
||||
|
||||
[context.next.environment]
|
||||
HUGO_ENABLEGITINFO = "true"
|
||||
|
|
|
|||
Loading…
Reference in a new issue