Bjørn Erik Pedersen e6abb9c3d0 config/security: Deny text/org content by default ...

Org export blocks and @@html:...@@ snippets pass raw HTML through
unescaped, making text/org the same XSS sink as text/html, which is
already denied. Sites with Org content can opt back in via
security.allowContent.

Thanks to @philipdissert for finding and reporting this issue.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 22:49:08 +02:00

..

allconfig

config/allconfig: Improve resilience of hugo mod init

2026-08-30 18:06:10 +02:00

privacy

Remove some old deprecations

2026-07-29 20:48:47 +02:00

security

config/security: Deny text/org content by default

2026-08-30 22:49:08 +02:00

services

Remove some old deprecations

2026-07-29 20:48:47 +02:00

testconfig

Add image processing support for AVIF

2026-05-26 12:13:53 +02:00

commonConfig_test.go

all: Run modernize -fix ./...

2025-02-26 11:44:25 +01:00

commonConfig.go

resources: Support babel/postcss config variants

2026-06-18 16:22:10 +02:00

configLoader_test.go

config: Increase test coverage

2025-07-07 11:27:34 +02:00

configLoader.go

config: Allow repeating the root key in /config files

2026-05-13 18:22:01 +02:00

configProvider_test.go

Misc config loading fixes

2021-06-14 17:00:32 +02:00

configProvider.go

Add modulequeries file cache for module version queries

2026-01-24 14:25:34 +01:00

defaultConfigProvider_test.go

Rename common/maps to common/hmaps (#14384)

2026-01-16 11:47:46 +01:00

defaultConfigProvider.go

Rename common/maps to common/hmaps (#14384)

2026-01-16 11:47:46 +01:00

env_test.go

tests: Convert from testify to quicktest

2019-08-12 13:26:32 +02:00

env.go

all: Run gofumpt -l -w .

2024-01-28 23:14:09 +01:00

namespace_test.go

Rename common/maps to common/hmaps (#14384)

2026-01-16 11:47:46 +01:00

namespace.go

resources: Fix 2 image file cache key issues

2025-01-18 12:23:18 +01:00