Disabling referrer in CP breaks images loaded from protected server in CP/Live Preview

This is a pretty obscure one, but FWIW...

In the 2.6.3006 update, the following feature was added:

The Control Panel now prevents referrer information from being sent when following links, on supporting browsers.

I figure that was the addition of <meta name="referrer" content="no-referrer"> to _layouts/base.html.

I take it the purpose of this is to not leak the CP address if an external link is clicked, but unfortunately it also breaks image loading in the CP for images hosted on an external server with hot-linking disabled. The external server requires the referrer header to authorise the request, and otherwise returns 403. For us this is breaking external entry images in Live Preview.

I've resolved this by commenting it out for now, but that's obviously not a long term solution. I agree the new behavior is probably the appropriate default, but would it be possible to have a config flag that could be set to disable it?

Thanks! :)

Start by reading _layouts/base.html and reviewing the referrer behavior introduced in the 2.6.3006 update. Reproduce Live Preview with an external image server that requires the referrer header. Done means the default privacy behavior remains available while a configuration option can allow protected external images to load in the Control Panel.