Redmine

Currently image thumbnails are created using shell outs to ImageMagick's convert tool.

There are multiple reason, why this might need to be changed. I do not want to list them here though, since they are largely fueled by FUD. Nevertheless, the latest ImageMagick security bug lead us to investigate alternatives to create thumbnails.

We came up with the following patch, which uses GD Graphics Library aka gdlib, gdlib2, or gdlib3.

The changes

• remove the newly introduced dependency to mimemagic, since there is no immediate need to verify the mime type of the image anymore.
• use the local-fastimage_resize gem¹ to perform the transformation.
• remove support for BMPs since libgd does not support them in all cases

Please note, that this will probably not work on Windows or JRuby, since interaction with libgd is done via its C API in a native c extension of the fastimage_resize gem.

¹ local-fastimage_resize is a fork of fastimage_resize. We've created the fork to remove support for remote image handing, which was not needed in the Redmine use case.