Fix prevention of direct symlink reads in resources.Get

* Note for themes, this is only an issue for themes stored locally, e.g. below `themes/...`. Themes mounted as modules from GitHub gets symlinks stripped away.
* Thas was also not an issue for file reading walking one or more directories.
* This is an regression introduced in `v0.123.0`.
This commit is contained in:
Bjørn Erik Pedersen
2026-05-11 12:52:53 +02:00
parent 86fbb0f7a8
commit f8b5fa09a6
5 changed files with 90 additions and 1 deletions
+39
View File
@@ -0,0 +1,39 @@
[windows] skip
ln ./rootfile.txt ./themes/mytheme/assets/modassetsymlink.txt
ln ./rootfile.txt ./themes/mytheme/static/modstaticsymlink.txt
ln ./README.md ./content/pagesymlink.md
hugo
grep 'OK' public/index.html
! grep 'FAIL' public/index.html
tree public
stdout modassetok
! stdout modassetsymlink
stdout 'modstatictok'
! stdout 'modstaticsymlink'
stdout pageok
! stdout pagesymlink
-- hugo.toml --
disableKinds = ["taxonomy", "term", "rss"]
[[module.imports]]
path = 'mytheme'
-- README.md --
Read me.
-- layouts/all.html --
{{ with resources.Get "modassetok.txt"}}OK {{ .Publish }}{{ else }}FAIL{{ end }}
{{ with resources.Get "modassetsymlink.txt"}}FAIL {{ .Publish }}{{ else }}OK{{ end }}
Page: {{ .RelPermalink }}|{{ .Content }}|
-- content/pageok.md --
-- themes/mytheme/assets/modassetok.txt --
Content.
-- themes/mytheme/static/modstatictok.txt --
Content.
-- rootfile.txt --
Roo Content.