ENHANCEMENT: If Installed, Load Vendor Files Locally

[twatzl]

Bug Report

Describe the bug

Pretty much as the title says. The scripts are still loaded from cloudflare even though setting enableCDN=false

To Reproduce

1. create page
2. enable highlightjs
3. disable cdn

Expected behavior

When enableCDN=false no scripts are loaded from external pages.

I guess the issue is line 48 in this file: https://github.com/pacollins/hugo-future-imperfect-slim/blob/master/layouts/partials/head.html

If I have time I might open a PR. Maybe next weekend or so, but for now I am busy getting my blog to work again.

[pacollins]

It is functioning as intended at the moment. We no longer host all of the different highlighting themes as part of the theme because of bloat.

If .Site.Params.highlightjsTheme is included, it loads that theme via CDN. If it is left blank, then it loads the default.css theme. The could probably be reworked to allow for users to download and implement custom themes for highlight.js.

hugo-future-imperfect-slim/layouts/partials/head.html

Lines 46 to 52 in 80efb2d

	{{- if $.Site.Params.highlightjs -}}
	{{ with $.Site.Params.highlightjsTheme }}
	<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/10.0.3/styles/{{ . }}.min.css">
	{{ else }}
	{{- $cssSlice = $cssSlice | append (resources.Get "css/default.css") -}}
	{{ end }}
	{{- end -}}

The easy solution to make this better understood is to make sure that highlightjsTheme is blank in the example config.

Hope that helps - I am happy to continue the discussion.

[twatzl]

Thanks. Ok. For me it's kinda unexpected to have CDNs still load when explicitely disabled. So I would rather have a note saying "Hey you gotta manually download the highlight.js theme and put it in your static folder if you disable CDN." It would be ok for me having to tweak that manually rather than using a CDN. Also you have to keep in mind that in Europe with GDPR it's quite a sensitive topic as I would have to inform my users, offer opt out and so on. I mean I would probably be fine, but also I don't want to risk any fines for a private blog, so in order to be 100% sure disabling all external things is the safer way.

In short: I would rather throw an error and have the user manually download the theme.

[pacollins]

Noted! I am an American and a hobbyist, so I have 0 understanding of GDPR. Let's work out a way to fix this and get it GDPR compliant! :)

…

On Sun, Jan 24, 2021 at 1:24 PM twatzl ***@***.***> wrote: Thanks. Ok. For me it's kinda unexpected to have CDNs still load when explicitely disabled. So I would rather have a note saying "Hey you gotta manually download the highlight.js theme and put it in your static folder if you disable CDN." It would be ok for me having to tweak that manually rather than using a CDN. Also you have to keep in mind that in Europe with GDPR it's quite a sensitive topic as I would have to inform my users, offer opt out and so on. I mean I would probably be fine, but also I don't want to risk any fines for a private blog, so in order to be 100% sure disabling all external things is the safer way. In short: I would rather throw an error and have the user manually download the theme. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#218 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACWVJSJT65TRNJ6SUJVPKG3S3RQXPANCNFSM4WQVXUNA> .

[twatzl]

As I said I would simply extend the documentation and let user put the scripts there manually and not load external scripts at all if enableCDN=false. That way there is nothing unexpected happening.

I think according to GDPR the use of CDNs would even be an exemption (as it's a technical requirement), but I am not a lawyer and so I rather disable all CDNs.

Edit: I might have time to create a PR for this in the coming weeks, but I can't promise anything.

[pacollins]

I have updated the Wiki, but I think we can get creative and have the theme recognize a local default and prioritize that.

I am changing the name of this issue to reflect an improvement on this block of code.

[VincentTam]

@twatzl As I'm living in 🇫🇷, I'd love to know more about GDPR. I've a workaround for this problem in GitHub Actions and/or GitLab CI & CD: manually fetch the a copy of the script during the site build (in .github/workflow/{file}.yml and/or .gitlab-ci.yml) if highlightjs = true in config.js.

hljsTheme=$((grep highlightjsTheme config.toml || echo "default") | awk '{ print $NF }' | tr -d '"')
curl -L -O "https://cdnjs.cloudflare.com/ajax/libs/highlight.js/{VERS}/styles/$hljsTheme.min.css"

so that during page rendering, the highlight.js theme file is fetched from {baseURL}$hljsTheme.min.css