The getImageURI() modding also works in the backend as I just tested.
If the "on the fly" really should be made more secure, then the $_GET must be completely banished (from the "on the fly", not in general).
That's no problem, according to the source code. $_GET just needs to rewrite to a normal array that will be filled first.
That needs more testing and code reviews in several other areas. For example it will for sure break image embedding via TinyMCE and tinyZenpage. THe latter is scheduled for rework but not for 1.x anymore.
Comments
The getImageURI() modding also works in the backend as I just tested.
If the "on the fly" really should be made more secure, then the $_GET must be completely banished (from the "on the fly", not in general).
That's no problem, according to the source code. $_GET just needs to rewrite to a normal array that will be filled first.
That needs more testing and code reviews in several other areas. For example it will for sure break image embedding via TinyMCE and tinyZenpage. THe latter is scheduled for rework but not for 1.x anymore.