3 files changed, 36 insertions, 6 deletions
diff --git a/mediagoblin/submit/routing.py b/mediagoblin/submit/routing.py
index cff28acb..3edbab70 100644
--- a/mediagoblin/submit/routing.py
+++ b/mediagoblin/submit/routing.py
@@ -20,5 +20,5 @@ submit_routes = [
     Route('mediagoblin.submit.start', '/',
           controller='mediagoblin.submit.views:submit_start'),
     Route('mediagoblin.submit.success', '/success/',
-          controller='mediagoblin.submit.views:submit_success'),
-    ]
+          template='mediagoblin/submit/success.html',
+          controller='mediagoblin.views:simple_template_render')]
diff --git a/mediagoblin/submit/security.py b/mediagoblin/submit/security.py
new file mode 100644
index 00000000..b2cb6d88
--- /dev/null
+++ b/mediagoblin/submit/security.py
@@ -0,0 +1,26 @@
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011 Free Software Foundation, Inc
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from mimetypes import guess_type
+
+
+ALLOWED = ['image/jpeg', 'image/png', 'image/tiff', 'image/gif']
+
+def check_filetype(posted_file):
+    if not guess_type(posted_file.filename)[0] in ALLOWED:
+        return False
+
+    return True
diff --git a/mediagoblin/submit/views.py b/mediagoblin/submit/views.py
index d4ecc75a..e9b5c37e 100644
--- a/mediagoblin/submit/views.py
+++ b/mediagoblin/submit/views.py
@@ -21,7 +21,7 @@ from werkzeug.utils import secure_filename
 
 from mediagoblin.util import render_to_response, redirect
 from mediagoblin.decorators import require_active_login
-from mediagoblin.submit import forms as submit_forms
+from mediagoblin.submit import forms as submit_forms, security
 from mediagoblin.process_media import process_media_initial
 
 
@@ -38,6 +38,9 @@ def submit_start(request):
                 and request.POST['file'].file):
             submit_form.file.errors.append(
                 u'You must provide a file.')
+        elif not security.check_filetype(request.POST['file']):
+            submit_form.file.errors.append(
+                u'The file doesn\'t seem to be an image!')
         else:
             filename = request.POST['file'].filename
 
@@ -77,11 +80,12 @@ def submit_start(request):
 
             return redirect(request, "mediagoblin.submit.success")
 
-    return render_to_response(request,
+    return render_to_response(
+        request,
         'mediagoblin/submit/start.html',
         {'submit_form': submit_form})
 
 
 def submit_success(request):
-    return render_to_response(request,
-        'mediagoblin/submit/success.html', {})
+    return render_to_response(
+        request, 'mediagoblin/submit/success.html', {})