N°10202 - CEX: Inline image as URL unreadable due to security fix

[accognet]

internal

[Copilot]

🟢 Approval recommended

Authentication remains enabled by default, and the only retained finding is a nonblocking wording correction.

1 open finding

• Fix authentication option description wording · New

What changed in this PR

Adds an opt-in setting to support inline-image access from third-party integrations without login.

Changes:

• Adds a configuration flag, disabled by default.
• Skips inline-image login enforcement when the flag is enabled.

File	Description
pages/​ajax.document.php	Makes inline-image login conditional on configuration.
core/​config.class.inc.php	Defines the option and documents unauthenticated access.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; anonymous image access is opt-in and still requires a matching image secret.

Summary

Adds security.disable_inline_images_protection so third-party tools can display inline images without logging in.

• Inline-image URLs can skip login when protection is disabled.

_{Reviews (1) · Last reviewed commit: "N°10202 - Third-party tool interface; in..." · Reviewed by Greptile}

[Molkobain]

Using a dedicated security flag for these specific use cases seems like a good idea, well done.

Just some remark about naming and convention.

[rquetiez]

From my point of view, the security remains correct when fetching the images require authentication : the secret acts as a bearer token and protects against malicious access to all database images.

[Molkobain]

Great thanks!