Always use content to resolve content type in resources.GetRemote

Browse Source

This is a security hardening measure; don't trust the URL extension or any `Content-Type`/`Content-Disposition` header on its own, always look at the file content using Go's `http.DetectContentType`.

This commit also adds ttf and otf media type definitions to Hugo.

Fixes #9302
Fixes #9301

...

This commit is contained in:

Bjørn Erik Pedersen

2021-12-16 15:12:13 +01:00

parent 22ef5da20d

commit 44954497bc

26 changed files with 378 additions and 49 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

media/testdata/resource.ttf vendored Normal file

Binary file not shown.