diff options
| -rw-r--r-- | mediagoblin/submit/security.py | 32 | ||||
| -rw-r--r-- | mediagoblin/submit/views.py | 5 |
2 files changed, 36 insertions, 1 deletions
diff --git a/mediagoblin/submit/security.py b/mediagoblin/submit/security.py new file mode 100644 index 00000000..db4c860d --- /dev/null +++ b/mediagoblin/submit/security.py @@ -0,0 +1,32 @@ +# GNU MediaGoblin -- federated, autonomous media hosting +# Copyright (C) 2011 Free Software Foundation, Inc +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +from mimetypes import guess_type + +from Image import open as image_open + +ALLOWED = ['image/jpeg', 'image/png', 'image/tiff', 'image/gif'] + +def check_filetype(posted_file): + if not guess_type(posted_file.filename) in ALLOWED: + return False + + try: + image = image_open(posted_file.file) + except IOError: + return False + + return True diff --git a/mediagoblin/submit/views.py b/mediagoblin/submit/views.py index b409b64d..e9b5c37e 100644 --- a/mediagoblin/submit/views.py +++ b/mediagoblin/submit/views.py @@ -21,7 +21,7 @@ from werkzeug.utils import secure_filename from mediagoblin.util import render_to_response, redirect from mediagoblin.decorators import require_active_login -from mediagoblin.submit import forms as submit_forms +from mediagoblin.submit import forms as submit_forms, security from mediagoblin.process_media import process_media_initial @@ -38,6 +38,9 @@ def submit_start(request): and request.POST['file'].file): submit_form.file.errors.append( u'You must provide a file.') + elif not security.check_filetype(request.POST['file']): + submit_form.file.errors.append( + u'The file doesn\'t seem to be an image!') else: filename = request.POST['file'].filename |