3 commits

Author	SHA1	Message	Date
Bjørn Erik Pedersen	6779117f72	media: Also consider extension in FromContent ... As used in `resources.GetRemote`. This will now reject image files with text and text files with images.	2021-12-22 11:35:53 +01:00
Bjørn Erik Pedersen	44954497bc	Always use content to resolve content type in resources.GetRemote ... This is a security hardening measure; don't trust the URL extension or any `Content-Type`/`Content-Disposition` header on its own, always look at the file content using Go's `http.DetectContentType`. This commit also adds ttf and otf media type definitions to Hugo. Fixes #9302 Fixes #9301	2021-12-17 09:50:28 +01:00
Bjørn Erik Pedersen	22ef5da20d	Add resources.GetRemote ... In Hugo 0.89 we added remote support to `resources.Get`. In hindsight that was not a great idea, as a poll from many Hugo users showed. See Issue #9285 for more details. After this commit `resources.Get` only supports local resource lookups. If you want to support both, you need to use a construct similar to: Also improve some option case handling. ``` {{ resource := "" }} {{ if (urls.Parse $url).IsAbs }} {{ $resource = resources.GetRemote $url }} {{ else }} {{ $resource = resources.Get $url }} {{ end }} ``` Fixes #9285 Fixes #9296	2021-12-17 09:33:51 +01:00