Possible bug: /config/_default/security.toml is ignored

[techmagus]

I use Pandoc in one of my sites and also I am using the /config/ method.

In /config/_default/ folder:

1. create: security.toml
2. the content:

enableInlineShortcodes = false
[security.exec]
  allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$', '^pandoc$']
  osEnv = ['(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$']

[security.funcs]
  getenv = ['^HUGO_']

[security.http]
  methods = ['(?i)GET|POST']
  urls = ['.*']

When I am building the site, I get this error:

access denied: "pandoc" is not whitelisted in policy "security.exec.allow"; the current security configuration is:

[security]
  enableInlineShortcodes = false
  [security.exec]
    allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']
    osEnv = ['(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$']

  [security.funcs]
    getenv = ['^HUGO_']

  [security.http]
    methods = ['(?i)GET|POST']
    urls = ['.*']

However, if I add it in /config/_default/config.toml file it works.

EDIT: changed to /config/_default/ instead of simply /config/

[bep]

When you move these config sections to its own file, you need to “remove” the root, so [security.exec] becomes [exec] etc.

[techmagus]

Oh yeah! I keep forgetting those, I only remove the base one like [security].

Thanks for pointing it out!