diff --git a/archetypes/default.md b/archetypes/default.md deleted file mode 100644 index bd2ad4117..000000000 --- a/archetypes/default.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -linktitle: "" -description: "" -publishdate: "" -lastmod: "" -categories: [] -tags: [] -weight: 00 -slug: "" -aliases: [] -toc: false ---- diff --git a/archetypes/news/index.md b/archetypes/news/index.md new file mode 100644 index 000000000..42e207e6a --- /dev/null +++ b/archetypes/news/index.md @@ -0,0 +1,6 @@ +--- +title: "{{ replace .Name "-" " " | title }}" +description: "" +date: {{ .Date }} +--- + diff --git a/config.toml b/config.toml index 7888579fe..ef8d99d6d 100644 --- a/config.toml +++ b/config.toml @@ -2,6 +2,7 @@ baseURL = "https://gohugo.io/" paginate = 100 defaultContentLanguage = "en" enableEmoji = true +timeZone = "Europe/Oslo" # Set the unicode character used for the "return" link in page footnotes. footnotereturnlinkcontents = "↩" languageCode = "en-us" diff --git a/config/_default/security.toml b/config/_default/security.toml new file mode 100644 index 000000000..2be3f1ba8 --- /dev/null +++ b/config/_default/security.toml @@ -0,0 +1,13 @@ + + enableInlineShortcodes = false + + [exec] + allow = ['^go$'] + osEnv = ['^PATH$'] + + [funcs] + getenv = ['^HUGO_', '^REPOSITORY_URL$', '^BRANCH$'] + + [http] + methods = ['(?i)GET|POST'] + urls = ['.*'] diff --git a/content/en/about/security-model/index.md b/content/en/about/security-model/index.md index 7a7841131..0aec55560 100644 --- a/content/en/about/security-model/index.md +++ b/content/en/about/security-model/index.md @@ -21,14 +21,29 @@ Hugo produces static output, so once built, the runtime is the browser (assuming But when developing and building your site, the runtime is the `hugo` executable. Securing a runtime can be [a real challenge](https://blog.logrocket.com/how-to-protect-your-node-js-applications-from-malicious-dependencies-5f2e60ea08f9/). -**Hugo's main approach is that of sandboxing:** +**Hugo's main approach is that of sandboxing and a security policy with strict defaults:** * Hugo has a virtual file system and only the main project (not third-party components) is allowed to mount directories or files outside the project root. * Only the main project can walk symbolic links. * User-defined components have only read-access to the filesystem. -* We shell out to some external binaries to support [Asciidoctor](/content-management/formats/#list-of-content-formats) and similar, but those binaries and their flags are predefined. General functions to run arbitrary external OS commands have been [discussed](https://github.com/gohugoio/hugo/issues/796), but not implemented because of security concerns. +* We shell out to some external binaries to support [Asciidoctor](/content-management/formats/#list-of-content-formats) and similar, but those binaries and their flags are predefined and disabled by default (see [Security Policy](#security-policy)). General functions to run arbitrary external OS commands have been [discussed](https://github.com/gohugoio/hugo/issues/796), but not implemented because of security concerns. -Hugo will soon introduce a concept of _Content Source Plugins_ (AKA _Pages from Data_), but the above will still hold true. + +## Security Policy + +{{< new-in "0.91.0" >}} + +Hugo has a built-in security policy that restricts access to [os/exec](https://pkg.go.dev/os/exec), remote communication and similar. + +The default configuration is listed below. And build using features not whitelisted in the security policy will faill with a detailed message about what needs to be done. Most of these settings are whitelists (string or slice, [Regular Expressions](https://pkg.go.dev/regexp) or `none` which matches nothing). + +{{< code-toggle config="security" />}} + +Note that these and other config settings in Hugo can be overridden by the OS environment. If you want to block all remote HTTP fetching of data: + +``` +HUGO_SECURITY_HTTP_URLS=none hugo +``` ## Dependency Security diff --git a/content/en/content-management/image-processing/index.md b/content/en/content-management/image-processing/index.md index 8f84145ac..0211f6fcd 100644 --- a/content/en/content-management/image-processing/index.md +++ b/content/en/content-management/image-processing/index.md @@ -305,7 +305,7 @@ bgColor = "#ffffff" # disk space reasons more than anything. # If you want it all, put ".*" in this config setting. # Note that if neither this or ExcludeFields is set, Hugo will return a small -# default set. +# default set: GPS|Exif|Exposure[M|P|B]|Contrast|Resolution|Sharp|JPEG|Metering|Sensing|Saturation|ColorSpace|Flash|WhiteBalance includeFields = "" # Regexp matching the Exif fields you want to exclude. This may be easier to use diff --git a/content/en/functions/images/index.md b/content/en/functions/images/index.md index 350d005ee..92c6ff0da 100644 --- a/content/en/functions/images/index.md +++ b/content/en/functions/images/index.md @@ -128,7 +128,7 @@ images.GaussianBlur SIGMA GaussianBlur creates a filter that applies a gaussian blur to an image. -### Grayscale +## Grayscale {{% funcsig %}} images.Grayscale diff --git a/content/en/getting-started/configuration.md b/content/en/getting-started/configuration.md index 0f48c39e3..2123558d9 100644 --- a/content/en/getting-started/configuration.md +++ b/content/en/getting-started/configuration.md @@ -381,6 +381,10 @@ Maximum number of items in the RSS feed. ### sectionPagesMenu See ["Section Menu for Lazy Bloggers"](/templates/menu-templates/#section-menu-for-lazy-bloggers). +### security + +See [Security Policy](/about/security-model/#security-policy) + ### sitemap Default [sitemap configuration](/templates/sitemap-template/#configure-sitemapxml). diff --git a/content/en/hugo-pipes/introduction.md b/content/en/hugo-pipes/introduction.md index 7cace938a..babf9cdb8 100755 --- a/content/en/hugo-pipes/introduction.md +++ b/content/en/hugo-pipes/introduction.md @@ -18,25 +18,32 @@ toc: true aliases: [/assets/] --- -## Get Resource with resources.Get +## Get Resource with resources.Get and resources.GetRemote -In order to process an asset with Hugo Pipes, it must be retrieved as a `Resource` using `resources.Get`. The first argument can be either a local the path to file relative to the `asset` directory/directories or a remote URL. +In order to process an asset with Hugo Pipes, it must be retrieved as a `Resource` using `resources.Get` or `resources.GetRemote`. + +With `resources.Get`, the first argument is a local path relative to the `assets` directory/directories: ```go-html-template {{ $local := resources.Get "sass/main.scss" }} -{{ $remote := resources.Get "https://www.example.com/styles.scss" }} ``` -`resources.Get` will always return `nil` if the resource could not be found. +With `resources.GetRemote`, the first argument is a remote URL: + +```go-html-template +{{ $remote := resources.GetRemote "https://www.example.com/styles.scss" }} +``` + +`resources.Get` and `resources.GetRemote` return `nil` if the resource is not found. ### Error Handling -{{< new-in "0.90.1" >}} +{{< new-in "0.91.0" >}} -The return value from `resources.Get` includes an `.Err` method that will return an error if the call failed. If you want to just log any error as a `WARNING` you can use a construct similar to the one below. +The return value from `resources.GetRemote` includes an `.Err` method that will return an error if the call failed. If you want to just log any error as a `WARNING` you can use a construct similar to the one below. ```go-html-template -{{ with resources.Get "https://gohugo.io/images/gohugoio-card-1.png" }} +{{ with resources.GetRemote "https://gohugo.io/images/gohugoio-card-1.png" }} {{ with .Err }} {{ warnf "%s" . }} {{ else }} @@ -49,22 +56,22 @@ Note that if you do not handle `.Err` yourself, Hugo will fail the build the fir ### Remote Options -When fetching a remote `Resource`, `resources.Get` takes an optional options map as the last argument, e.g.: +When fetching a remote `Resource`, `resources.GetRemote` takes an optional options map as the last argument, e.g.: ```go-html-template -{{ $resource := resources.Get "https://example.org/api" (dict "headers" (dict "Authorization" "Bearer abcd")) }} +{{ $resource := resources.GetRemote "https://example.org/api" (dict "headers" (dict "Authorization" "Bearer abcd")) }} ``` If you need multiple values for the same header key, use a slice: ```go-html-template -{{ $resource := resources.Get "https://example.org/api" (dict "headers" (dict "X-List" (slice "a" "b" "c"))) }} +{{ $resource := resources.GetRemote "https://example.org/api" (dict "headers" (dict "X-List" (slice "a" "b" "c"))) }} ``` You can also change the request method and set the request body: ```go-html-template -{{ $postResponse := resources.Get "https://example.org/api" (dict +{{ $postResponse := resources.GetRemote "https://example.org/api" (dict "method" "post" "body" `{"complete": true}` "headers" (dict @@ -75,16 +82,15 @@ You can also change the request method and set the request body: ### Caching of Remote Resources -Remote resources fetched with `resources.Get` will be cached on disk. See [Configure File Caches](/getting-started/configuration/#configure-file-caches) for details. +Remote resources fetched with `resources.GetRemote` will be cached on disk. See [Configure File Caches](/getting-started/configuration/#configure-file-caches) for details. ## Asset directory Asset files must be stored in the asset directory. This is `/assets` by default, but can be configured via the configuration file's `assetDir` key. - ### Asset Publishing -Assets will only be published (to `/public`) if `.Permalink` or `.RelPermalink` is used. You can use `.Content` to inline the asset. +Hugo publishes assets to the to the `publishDir` (typically `public`) when you invoke `.Permalink`, `.RelPermalink`, or `.Publish`. You can use `.Content` to inline the asset. ## Go Pipes diff --git a/content/en/news/2021-12-17-no-more-releasenotes.md b/content/en/news/2021-12-17-no-more-releasenotes.md new file mode 100644 index 000000000..38bd75357 --- /dev/null +++ b/content/en/news/2021-12-17-no-more-releasenotes.md @@ -0,0 +1,10 @@ +--- +title: "Release Notes now on GitHub Only" +date: 2021-12-17T12:22:47+01:00 +slug: "no-more-releasenotes-here" +description: "Hugo Release Notes now gets released on GitHub Only" + +--- + +For details about release notes, you need to go here: https://github.com/gohugoio/hugo/releases -- see this for an Atom feed: https://github.com/gohugoio/hugo/releases.atom + diff --git a/content/en/news/2021/0.91.2-relnotes/featured.png b/content/en/news/2021/0.91.2-relnotes/featured.png new file mode 100644 index 000000000..fddcb22eb Binary files /dev/null and b/content/en/news/2021/0.91.2-relnotes/featured.png differ diff --git a/content/en/news/2021/0.91.2-relnotes/index.md b/content/en/news/2021/0.91.2-relnotes/index.md new file mode 100644 index 000000000..03654bf28 --- /dev/null +++ b/content/en/news/2021/0.91.2-relnotes/index.md @@ -0,0 +1,9 @@ +--- +title: "Fixes the “Stuck on Build” Bug" +description: "Hugo 0.91.2 is the last release before Christmas!" +date: 2021-12-23T17:47:41+01:00 +--- + +Read the full change log on [GitHub](https://github.com/gohugoio/hugo/releases/tag/v0.91.2). + +**Merry Christmas to all of you!** diff --git a/content/en/templates/data-templates.md b/content/en/templates/data-templates.md index 441cc2f10..cb3de7f9f 100644 --- a/content/en/templates/data-templates.md +++ b/content/en/templates/data-templates.md @@ -53,8 +53,8 @@ The example below is a bit contrived, but it illustrates the flexibility of data {{< code-toggle file="jacopastorius" >}} discography = [ -"1974 – Modern American Music … Period! The Criteria Sessions", -"1974 – Jaco", +"1974 - Modern American Music … Period! The Criteria Sessions", +"1974 - Jaco", "1976 - Jaco Pastorius", "1981 - Word of Mouth", "1981 - The Birthday Concert (released in 1995)", diff --git a/content/en/variables/files.md b/content/en/variables/files.md index 1769fa688..d8f3daece 100644 --- a/content/en/variables/files.md +++ b/content/en/variables/files.md @@ -40,7 +40,7 @@ The `.File` object contains the following fields: : the filename without extension (e.g., `foo.en`) .File.Ext -: the file extension of the content file (e.g., `md`); this can also be called using `.File.Extension` as well. Note that it is *only* the extension without `.`. +: the file extension of the content file (e.g., `md`). .File.Lang : the language associated with the given file if Hugo's [Multilingual features][multilingual] are enabled (e.g., `en`) diff --git a/content/en/variables/git.md b/content/en/variables/git.md index 59ee9ac88..58a285fd9 100644 --- a/content/en/variables/git.md +++ b/content/en/variables/git.md @@ -37,10 +37,10 @@ The `GitInfo` object contains the following fields: : the abbreviated commit hash (e.g., `866cbcc`) .AuthorName -: the author's name, respecting `.mailmap` +: the author's name, respecting [`.mailmap`](https://git-scm.com/docs/gitmailmap) .AuthorEmail -: the author's email address, respecting `.mailmap` +: the author's email address, respecting [`.mailmap`](https://git-scm.com/docs/gitmailmap) .AuthorDate : the author date diff --git a/content/en/variables/page.md b/content/en/variables/page.md index 4ba4d3d91..79b1447f8 100644 --- a/content/en/variables/page.md +++ b/content/en/variables/page.md @@ -33,6 +33,9 @@ See [`.Scratch`](/functions/scratch/) for page-scoped, writable variables. .Aliases : aliases of this page +.BundleType +: the [bundle] type: `leaf`, `branch`, or an empty string if the page is not a bundle. + .Content : the content itself, defined below the front matter. @@ -305,3 +308,4 @@ The top-level key will be preferred. Therefore, the following method, when appli [gitinfo]: /variables/git/ [File Variables]: /variables/files/ +[bundle]: {{< relref "content-management/page-bundles" >}} diff --git a/data/docs.json b/data/docs.json index 70a2eafb4..b270b2c9b 100644 --- a/data/docs.json +++ b/data/docs.json @@ -1775,9 +1775,15 @@ "permalinks": { "_merge": "none" }, + "privacy": { + "_merge": "none" + }, "related": { "_merge": "none" }, + "security": { + "_merge": "none" + }, "sitemap": { "_merge": "none" }, @@ -1822,6 +1828,33 @@ "keepWhitespace": false } } + }, + "security": { + "enableInlineShortcodes": false, + "exec": { + "allow": [ + "^dart-sass-embedded$", + "^go$", + "^npx$", + "^postcss$" + ], + "osEnv": [ + "(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$" + ] + }, + "funcs": { + "getenv": [ + "^HUGO_" + ] + }, + "http": { + "methods": [ + "(?i)GET|POST" + ], + "urls": [ + ".*" + ] + } } }, "media": { @@ -1954,6 +1987,34 @@ "yml" ] }, + { + "mainType": "font", + "subType": "otf", + "delimiter": ".", + "firstSuffix": { + "suffix": "otf", + "fullSuffix": ".otf" + }, + "type": "font/otf", + "string": "font/otf", + "suffixes": [ + "otf" + ] + }, + { + "mainType": "font", + "subType": "ttf", + "delimiter": ".", + "firstSuffix": { + "suffix": "ttf", + "fullSuffix": ".ttf" + }, + "type": "font/ttf", + "string": "font/ttf", + "suffixes": [ + "ttf" + ] + }, { "mainType": "image", "subType": "jpeg", @@ -1966,7 +2027,10 @@ "string": "image/jpeg", "suffixes": [ "jpg", - "jpeg" + "jpeg", + "jpe", + "jif", + "jfif" ] }, { @@ -4524,9 +4588,9 @@ "Examples": null }, "Get": { - "Description": "Get locates the filename given in Hugo's assets filesystem or downloads\na file from an URL and creates a Resource object that can be used for\nfurther transformations.\n\nFor URLs an additional argument with options can be provided.", + "Description": "Get locates the filename given in Hugo's assets filesystem and\ncreates a Resource object that can be used for\nfurther transformations.", "Args": [ - "args" + "filename" ], "Aliases": null, "Examples": [] @@ -4537,6 +4601,14 @@ "Aliases": null, "Examples": null }, + "GetRemote": { + "Description": "GetRemote gets the URL (via HTTP(s)) in the first argument in args and creates Resource object that can be used for\nfurther transformations.\n\nA second argument may be provided with an option map.\n\nNote: This method does not return any error as a second argument,\nfor any error situations the error can be checked in .Err.", + "Args": [ + "args" + ], + "Aliases": null, + "Examples": [] + }, "Match": { "Description": "", "Args": null, diff --git a/layouts/partials/maintenance-pages-table.html b/layouts/partials/maintenance-pages-table.html index 8538e2104..a2429a335 100644 --- a/layouts/partials/maintenance-pages-table.html +++ b/layouts/partials/maintenance-pages-table.html @@ -14,7 +14,7 @@ {{ .Title }} - + {{ with .GitInfo }}{{ .Subject }}{{ else }}Source{{ end }} diff --git a/netlify.toml b/netlify.toml index ada1d9afc..a44e1f38d 100644 --- a/netlify.toml +++ b/netlify.toml @@ -3,7 +3,7 @@ publish = "public" command = "hugo --gc --minify" [context.production.environment] -HUGO_VERSION = "0.90.1" +HUGO_VERSION = "0.91.2" HUGO_ENV = "production" HUGO_ENABLEGITINFO = "true" @@ -11,20 +11,20 @@ HUGO_ENABLEGITINFO = "true" command = "hugo --gc --minify --enableGitInfo" [context.split1.environment] -HUGO_VERSION = "0.90.1" +HUGO_VERSION = "0.91.2" HUGO_ENV = "production" [context.deploy-preview] command = "hugo --gc --minify --buildFuture -b $DEPLOY_PRIME_URL" [context.deploy-preview.environment] -HUGO_VERSION = "0.90.1" +HUGO_VERSION = "0.91.2" [context.branch-deploy] command = "hugo --gc --minify -b $DEPLOY_PRIME_URL" [context.branch-deploy.environment] -HUGO_VERSION = "0.90.1" +HUGO_VERSION = "0.91.2" [context.next.environment] HUGO_ENABLEGITINFO = "true"