Add config option for HTML render mode

[kookxiang]

As in #2593 , you add a ?render=1 which could render html file instead of raw mode.

This may lead to a security problem.

1. First, a user upload a repository, like https://try.gogs.io/kookxiang/demo
2. Then, the user can send a link to admin with the render param, like: https://try.gogs.io/kookxiang/demo/raw/master/index.htm?render=1
3. When other user access that page, my ssh key was insert into their setting. (check in https://try.gogs.io/user/settings/ssh , with this method, they could do anything you can do without password confirm)

Just like Github, an html cannot be render under github.com domain.
So they use a github.io domain to keep main domain secure.

Please remove this param, or at least move the option into config file.

[rugk]

Oh, this is a security vulnerability and you may have reported it privately to @unknwon. However once it is public now it should be fixed as fast as possible.

[pgaskin]

I would like this option to remain because I depend on it, but it should be off by default for security reasons.

[pgaskin]

Have a look at go-gitea/gitea#685 . I have added an option which moves this into the config file.

[unknwon]

Patch has pushed to fix this issue, please test on develop branch or https://try.gogs.io.

This is disabled by default, see details b3c4a39.