feat: complete remediation phase 3

backend/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"log"
 	"os"
 	"strconv"
 )
@@ -49,6 +50,11 @@ func Load() *Config {
 	cfg.VersionsDir = cfg.StorageDir + "/.versions"
 	cfg.BackupDir = cfg.StorageDir + "/.backups"
 
+	if cfg.OnlyOfficeJWT == "" {
+		log.Println("WARNING: ONLYOFFICE_JWT_SECRET not set \u2014 Document Server requests will NOT be authenticated.")
+		log.Println("         Anyone with network access to the Document Server can open/edit documents.")
+	}
+
 	return cfg
 }