Fixed the security hole (really, I'm a moron - used $failed > $threshold instead of $failed >= $threashold) and patched up some...erm... math issues
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>{$lang_insert_image_title}</title>
<script language="javascript" type="text/javascript" src="../../tiny_mce_popup.js"></script>
<script language="javascript" type="text/javascript" src="../../utils/mctabs.js"></script>
<script language="javascript" type="text/javascript" src="../../utils/form_utils.js"></script>
<script language="javascript" type="text/javascript" src="jscripts/image.js"></script>
<base target="_self" />
</head>
<body id="image" onload="tinyMCEPopup.executeOnLoad('init();');" style="display: none">
<form onsubmit="insertImage();return false;" action="#">
<div class="tabs">
<ul>
<li id="general_tab" class="current"><span><a href="javascript:mcTabs.displayTab('general_tab','general_panel');" onmousedown="return false;">{$lang_insert_image_title}</a></span></li>
</ul>
</div>
<div class="panel_wrapper">
<div id="general_panel" class="panel current">
<table border="0" cellpadding="4" cellspacing="0">
<tr>
<td nowrap="nowrap"><label for="src">{$lang_insert_image_src}</label></td>
<td><table border="0" cellspacing="0" cellpadding="0">
<tr>
<td><input id="src" name="src" type="text" value="" style="width: 200px" onchange="getImageData();"></td>
<td id="srcbrowsercontainer"> </td>
</tr>
</table></td>
</tr>
<!-- Image list -->
<script language="javascript">
if (typeof(tinyMCEImageList) != "undefined" && tinyMCEImageList.length > 0) {
var html = "";
html += '<tr><td><label for="image_list">{$lang_image_list}</label></td>';
html += '<td><select id="image_list" name="image_list" style="width: 200px" onchange="this.form.src.value=this.options[this.selectedIndex].value;resetImageData();getImageData();">';
html += '<option value="">---</option>';
for (var i=0; i<tinyMCEImageList.length; i++)
html += '<option value="' + tinyMCEImageList[i][1] + '">' + tinyMCEImageList[i][0] + '</option>';
html += '</select></td></tr>';
document.write(html);
}
</script>
<!-- /Image list -->
<tr>
<td nowrap="nowrap"><label for="alt">{$lang_insert_image_alt}</label></td>
<td><input id="alt" name="alt" type="text" value="" style="width: 200px"></td>
</tr>
<tr>
<td nowrap="nowrap"><label for="align">{$lang_insert_image_align}</label></td>
<td><select id="align" name="align">
<option value="">{$lang_insert_image_align_default}</option>
<option value="baseline">{$lang_insert_image_align_baseline}</option>
<option value="top">{$lang_insert_image_align_top}</option>
<option value="middle">{$lang_insert_image_align_middle}</option>
<option value="bottom">{$lang_insert_image_align_bottom}</option>
<option value="texttop">{$lang_insert_image_align_texttop}</option>
<option value="absmiddle">{$lang_insert_image_align_absmiddle}</option>
<option value="absbottom">{$lang_insert_image_align_absbottom}</option>
<option value="left">{$lang_insert_image_align_left}</option>
<option value="right">{$lang_insert_image_align_right}</option>
</select></td>
</tr>
<tr>
<td nowrap="nowrap"><label for="width">{$lang_insert_image_dimensions}</label></td>
<td><input id="width" name="width" type="text" value="" size="3" maxlength="3">
x
<input id="height" name="height" type="text" value="" size="3" maxlength="3"></td>
</tr>
<tr>
<td nowrap="nowrap"><label for="border">{$lang_insert_image_border}</label></td>
<td><input id="border" name="border" type="text" value="" size="3" maxlength="3"></td>
</tr>
<tr>
<td nowrap="nowrap"><label for="vspace">{$lang_insert_image_vspace}</label></td>
<td><input id="vspace" name="vspace" type="text" value="" size="3" maxlength="3"></td>
</tr>
<tr>
<td nowrap="nowrap"><label for="hspace">{$lang_insert_image_hspace}</label></td>
<td><input id="hspace" name="hspace" type="text" value="" size="3" maxlength="3"></td>
</tr>
</table>
</div>
</div>
<div class="mceActionPanel">
<div style="float: left">
<input type="button" id="insert" name="insert" value="{$lang_insert}" onclick="insertImage();" />
</div>
<div style="float: right">
<input type="button" id="cancel" name="cancel" value="{$lang_cancel}" onclick="tinyMCEPopup.close();" />
</div>
</div>
</form>
</body>
</html>