N°10075 - Update configuration parameters default value

[steffunky]

Base information

Question	Answer
Related to a SourceForge thread / Another PR / A GitHub Issue / Combodo ticket?	N°10075
Type of change?	Bug fix

Proposed solution (bug and enhancement)

Update the default value for these configuration parameters

Checklist before requesting a review

• I have performed a self-review of my code
• I have tested all changes I made on an iTop instance
• I have added a unit test, otherwise I have explained why I couldn't (unit test working w/ new default values)
• Is the PR clear and detailed enough so anyone can understand without digging in the code?

[Copilot]

Copilot review overview

🟡 Changes recommended

An existing integration test still asserts the previous endpoint-access default, and joined-filter default behavior lacks direct coverage.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Update login test for changed default authentication behavior · New
• Add coverage for unset join-filter configuration default · New

What changed in this PR

Updates security-related configuration defaults to enable joined-class filtering and forced login by default.

Changes:

• Enables joined/union class scope filtering by default.
• Forces authentication for unlisted module endpoints by default.
• Updates related comments.

File	Description
core/​dbunionsearch.class.php	Clarifies filtering configuration behavior.
core/​dbobjectsearch.class.php	Clarifies joined-class filtering behavior.
core/​config.class.inc.php	Changes both security defaults to false.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Changes default security filter settings for joined classes and login enforcement.

The PR appears safe to merge; no outstanding findings remain.

Summary

This PR changes the defaults to enable joined-class scope filtering and require login for module exec endpoints without a delegated-authentication list. It updates the login test’s default expectation and restores its teardown exception import.

_{Reviews (3) · Last reviewed commit: "Restore Exception import for teardown er..."}

[Molkobain]

PHPUnit tests remains to update, otherwise it looks good.

[Copilot]

Copilot review overview

🟡 Changes recommended

The removed exception import breaks teardown error handling, and the compatibility opt-out is no longer tested.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Restore Exception import for teardown error handling · New
• Update login test for changed default authentication behavior
• Add test coverage for exec forced-login opt-out setting · New
• Add coverage for unset join-filter configuration default

[Copilot]

Copilot review overview

🟢 Approval recommended

The defaults, implementation comments, and authentication tests consistently reflect the intended security behavior.

Review effort: Balanced
Findings: None

Resolved since last review (4)

• Restore Exception import for teardown error handling
• Update login test for changed default authentication behavior
• Add test coverage for exec forced-login opt-out setting
• Add coverage for unset join-filter configuration default