Bjørn Erik Pedersen e6abb9c3d0 config/security: Deny text/org content by default ...

Org export blocks and @@html:...@@ snippets pass raw HTML through
unescaped, making text/org the same XSS sink as text/html, which is
already denied. Sites with Org content can opt back in via
security.allowContent.

Thanks to @philipdissert for finding and reporting this issue.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 22:49:08 +02:00

..

skeletons

create/skeletons: Use css.Build in theme skeleton

2026-03-15 16:51:24 +01:00

content_test.go

config/security: Deny text/org content by default

2026-08-30 22:49:08 +02:00

content.go

create: Fix non-deterministic conflict detection in hugo new content

2026-04-18 15:06:28 +02:00