permission check missing

[vvvllll]

Checking the code i noticed there's no permission check, it would be a good idea to add

if(!current_user_can('edit_post', $attachment_id))exit; in save_image()

There's a nonce check but the nonce is visible with any user in admin pages, so even subscribers can add hotspot/faces and recrop all thumbs, and possibly non-auth users as well if they find a way to get a valid nonce.