Security fix make images deletable only by owner or admin