Merge remote-tracking branch 'gitorious/master'

mediagoblin/submit/security.py

@@ -0,0 +1,34 @@
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011 Free Software Foundation, Inc
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from mimetypes import guess_type
+
+from Image import open as image_open
+
+ALLOWED = ['image/jpeg', 'image/png', 'image/tiff', 'image/gif']
+
+def check_filetype(posted_file):
+    if not guess_type(posted_file.filename) in ALLOWED:
+        return False
+
+    # TODO: This should be handled by the processing stage.  We should
+    # handle error detection there.
+    try:
+        image = image_open(posted_file.file)
+    except IOError:
+        return False
+
+    return True

mediagoblin/submit/views.py

@@ -21,7 +21,7 @@ from werkzeug.utils import secure_filename
 
 from mediagoblin.util import render_to_response, redirect
 from mediagoblin.decorators import require_active_login
-from mediagoblin.submit import forms as submit_forms
+from mediagoblin.submit import forms as submit_forms, security
 from mediagoblin.process_media import process_media_initial
 
 
@@ -38,6 +38,9 @@ def submit_start(request):
                 and request.POST['file'].file):
             submit_form.file.errors.append(
                 u'You must provide a file.')
+        elif not security.check_filetype(request.POST['file']):
+            submit_form.file.errors.append(
+                u'The file doesn\'t seem to be an image!')
         else:
             filename = request.POST['file'].filename