N°10202 - CEX: Inline image as URL unreadable due to secuirty fix (#1079)

core/config.class.inc.php

@@ -1739,6 +1739,14 @@ class Config
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		],
+		'security.disable_mandatory_authentication_for_inline_images' => [
+			'type'                => 'bool',
+			'description' => 'If true then image access does not require user authentication, provided the image\'s secret is valid. Note that setting this to true gives a less secure access to inline images!',
+			'default'             => false,
+			'value'               => false,
+			'source_of_value'     => '',
+			'show_in_conf_sample' => false,
+		],
 		'security.disable_joined_classes_filter' => [
 			'type'                => 'bool',
 			'description'         => 'If true, scope filters aren\'t applied to joined classes or union classes not directly listed in the SELECT clause.',

pages/ajax.document.php

@@ -64,7 +64,9 @@ try {
 			break;
 
 		case 'download_inlineimage':
-			LoginWebPage::DoLoginEx();
+			if (MetaModel::GetConfig()->Get('security.disable_mandatory_authentication_for_inline_images') === false) {
+				LoginWebPage::DoLoginEx();
+			}
 			$id = utils::ReadParam('id', '');
 			$sSecret = utils::ReadParam('s', '');
 			$iCacheSec = 31556926; // One year ahead: an inline image cannot change