-* Set `$CGI::POST_MAX` to some sane value (ie, larger than the largest
- configured `maxsize()` in the pagespec, or if none is configured,
- something reasonable. Just as a belt-and-suspenders DOS prevention.
-* Only allow attachments to be added to a given list of pages.
- Maybe a pagespec like `parent(patches/*)`
+* An option to not `rcs_add` new attachments, but just write them to the
+ srcdir. This would allow the admin to review them, and manually
+ add/delete them before they bloat history.
+
+> I'd be inclined to implement that one by writing them to a nominated
+> underlay, I think, rather than having them in the srcdir but not in
+> the VCS. My [[plugins/contrib/album]] plugin could benefit from this
+> functionality, although in that case the photos should probably just
+> stay in the underlay forever (I already use an underlay on my own
+> websites for photos and software releases, which are too big to want
+> them in the VCS permanently.) --[[smcv]]
+
+[[!tag wishlist]]