The MediaController now validates the URL parameters 'id', 'propertyName', 'hash', 'cropName', 'width' and 'filename'. The missing validation was added for security reasons to prevent DOS attacks.

This change is considered breaking due to the validation, which now might deny requests which previously worked.

Valid URLs for media objects delivered by the MediaController are 'published' via the GraphQL schema in the properties 'uriTemplate' and 'fullyQualifiedUrl'

(CMS-21317)