Quickly looking at the code, there's one suggestion I can make:
Instead of code such as
if (!$_SESSION['user']) {
, you should be using something like:
if (!empty($_SESSION['user'])) {
or
if (!isset($_SESSION['user']))
Examples include lines 32, 38, 41, et al of thumbnail.php.
It's not a big deal, but in your config.php... you apparently parse this file using the parse_ini_file() function, so you might consider delimiting your comment lines with a semicolon instead of the double forward slash, as the comments that have equal signs in them are being parsed as key=value pairs. Again, not that big of a deal, but... shrug.