Currently image thumbnails are created using shell outs to ImageMagick's convert tool.

There are multiple reason, why this might need to be changed. I do not want to list them here though, since they are largely fueled by "FUD":https://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt. Nevertheless, the latest ImageMagick security bug lead us to investigate alternatives to create thumbnails.

We came up with the following patch, which uses GD Graphics Library aka gdlib, gdlib2, or gdlib3.

The changes

• remove the newly introduced dependency to mimemagic, since there is no immediate need to verify the mime type of the image anymore.
• use the @local-fastimage_resize@ gem[1] to perform the transformation.
• remove support for BMPs since libgd does not support them in all cases

Please note, that this will probably not work on Windows or JRuby, since interaction with libgd is done via its C API in a native c extension of the fastimage_resize gem.

fn1. "local-fastimage_resize":https://github.com/planio-gmbh/local-fastimage_resize is a fork of "fastimage_resize":https://github.com/sdsykes/fastimage_resize. We've created the fork to remove support for remote image handing, which was not needed in the Redmine use case.