Preserve ?render=media-popup when clicking "Edit image" from popup

hmm,

render is already listed as a safe option in media.module . These are cached and pulled from cache, maybe have a look at the way we're using cache_set and cache_get and the options.
There's a simpletest for this you can look at the code.

/* tests/media.test: */
    $retrieved_settings = cache_get('media_options:' . $cid, 'cache_form');

/* media.module */
    // Filter out everything except a whitelist of known safe options.
    $safe_options = array(
      'enabledPlugins',
      'fid',
      'id',
      'multiselect',
      'field',
      'options',
      'plugins',
      'render',
      'types',
      'render_multi_edit_form',
    );

have a look at sa contrib which brought in cache_set and cache_get
https://drupal.org/node/2877316

ok, the patch looks good , although I haven't actually tested it but I did review it.
shouldn't cause any security issues as the render parameter is already whitelisted.

actually, on second thought, would it be possible to try this patch with media 7.x-2.11?

For what reason are you still running version 2.2? is there a compatibility issue?

on the radar for commit soon

Thanks @xurizaemon, keep 'em comming.