The problem with the image picker come from Joomla. There is an opened ticket on this. You have to apply a patch.
Here the ticket :
joomlacode.org/gf/project/joomla/tracker...racker_item_id=25288
Not sure whether to use the uploader or the image picker. You mention that security is an issue, could you explain a little what the issue is, when you have a bit of time...
- The file uploader is when each different file relate to different database items. You cannot reuse an existing file to associate to another item. Each time you want to reuse a file, you have to upload it again.
In reallity, you can also combine both uploader and picker in differents forms, but I tell you the idea
- The imagepicker is much more used when you have a collection of images and you want to make associations. A same file can be reused many times.
Imagepicker only works with images.
About the security :
It depends who can upload...
If you allow the final user to upload, it is much more better to avoid the possibility to acces directly the uploaded file.
For example, a simple php script hidden inside an image can pass the mime validation and the 'getsize()' validation too. If the user can access DIRECTLY the file, it execute it and it is finished for you.
Well, there are many securities, CHMOD on file and on folder against execution...
For the sandbox, the problem was about direct file access. You can see that com_media has been hacked and you never discover the real files paths. Each image is called trough index.php?option=com_....
That's the main difference.
If you have choice, I encourage you to use the uploader. Your component is much more independent. Depends what you prefers. Also if you want indirect file access. com_media doesn't support this.