> This protection against malicious users is already given by preview_max_x and preview_max_y

Besides the fact that these two parameters have no default and as a result are not effective this will not help against creating all possible thumbnail sizes which as a result will spam the harddrive.

Assuming there is a max of 600x600 one could still request 360000 different thumbnail.

To finally get to a solution - do we need to get this sorted out to get this merged?