Right now it's only checked in XWikiServletRequest, but not everything goes through this (especially resource handelers handlers or any code which does not use oldcore APIs).
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
