From 217baaa317b57772f8eaa47d27b2892c64de9e2f Mon Sep 17 00:00:00 2001
From: Mikko Ohtamaa <mikko@opensourcehacker.com>
Date: Fri, 19 Jul 2013 01:34:57 +0300
Subject: [PATCH] Added image content type white list with python-magic

---
 avatar/forms.py           |  44 +++++++++++++++++++++++++++++---------
 avatar/settings.py        |   1 +
 avatar/testdata/test.tiff | Bin 0 -> 16358 bytes
 avatar/tests.py           |  37 +++++++++++++++++++-------------
 docs/usage.txt            |  24 +++++++++++++--------
 5 files changed, 72 insertions(+), 34 deletions(-)
 create mode 100644 avatar/testdata/test.tiff

diff --git a/avatar/forms.py b/avatar/forms.py
index 012ab08..902ec39 100644
--- a/avatar/forms.py
+++ b/avatar/forms.py
@@ -8,46 +8,70 @@ from django.template.defaultfilters import filesizeformat
 
 from avatar.models import Avatar
 from avatar.settings import (AVATAR_MAX_AVATARS_PER_USER, AVATAR_MAX_SIZE,
-                             AVATAR_ALLOWED_FILE_EXTS, AVATAR_DEFAULT_SIZE)
+                             AVATAR_ALLOWED_FILE_EXTS, AVATAR_DEFAULT_SIZE,
+                             AVATAR_ALLOWED_MIMETYPES)
 
 
 def avatar_img(avatar, size):
     if not avatar.thumbnail_exists(size):
         avatar.create_thumbnail(size)
-    return mark_safe("""<img src="%s" alt="%s" width="%s" height="%s" />""" % 
+    return mark_safe("""<img src="%s" alt="%s" width="%s" height="%s" />""" %
         (avatar.avatar_url(size), unicode(avatar), size, size))
 
+
 class UploadAvatarForm(forms.Form):
 
     avatar = forms.ImageField(label=_(u"avatar"))
-    
+
     def __init__(self, *args, **kwargs):
         self.user = kwargs.pop('user')
         super(UploadAvatarForm, self).__init__(*args, **kwargs)
-        
+
     def clean_avatar(self):
         data = self.cleaned_data['avatar']
+
+        if AVATAR_ALLOWED_MIMETYPES:
+            try:
+                import magic
+            except ImportError:
+                raise ImportError("python-magic library must be installed in order to use uploaded file content limitation")
+
+            # Construct 256 bytes needed for mime validation
+            magic_buffer = ""
+            for chunk in data.chunks():
+                magic_buffer += chunk
+                if len(magic_buffer) >= 256:
+                    break
+
+            # https://github.com/ahupp/python-magic#usage
+            mime = magic.from_buffer(magic_buffer, mime=True)
+
+            if mime not in AVATAR_ALLOWED_MIMETYPES:
+                raise forms.ValidationError(
+                    _(u"File content is invalid. Detected: %(mimetype)s Allowed content types are: %(valid_mime_list)s") %
+                    {'valid_mime_list': ", ".join(AVATAR_ALLOWED_MIMETYPES), "mimetype": mime})
+
         if AVATAR_ALLOWED_FILE_EXTS:
             (root, ext) = os.path.splitext(data.name.lower())
             if ext not in AVATAR_ALLOWED_FILE_EXTS:
                raise forms.ValidationError(
-                _(u"%(ext)s is an invalid file extension. Authorized extensions are : %(valid_exts_list)s") % 
-                { 'ext' : ext, 'valid_exts_list' : ", ".join(AVATAR_ALLOWED_FILE_EXTS) }) 
+                _(u"%(ext)s is an invalid file extension. Authorized extensions are : %(valid_exts_list)s") %
+                { 'ext' : ext, 'valid_exts_list' : ", ".join(AVATAR_ALLOWED_FILE_EXTS) })
         if data.size > AVATAR_MAX_SIZE:
             raise forms.ValidationError(
                 _(u"Your file is too big (%(size)s), the maximum allowed size is %(max_valid_size)s") %
                 { 'size' : filesizeformat(data.size), 'max_valid_size' : filesizeformat(AVATAR_MAX_SIZE)} )
         count = Avatar.objects.filter(user=self.user).count()
         if AVATAR_MAX_AVATARS_PER_USER > 1 and \
-           count >= AVATAR_MAX_AVATARS_PER_USER: 
+           count >= AVATAR_MAX_AVATARS_PER_USER:
             raise forms.ValidationError(
                 _(u"You already have %(nb_avatars)d avatars, and the maximum allowed is %(nb_max_avatars)d.") %
                 { 'nb_avatars' : count, 'nb_max_avatars' : AVATAR_MAX_AVATARS_PER_USER})
-        return        
-        
+        return
+
 
 class PrimaryAvatarForm(forms.Form):
-    
+
     def __init__(self, *args, **kwargs):
         user = kwargs.pop('user')
         size = kwargs.pop('size', AVATAR_DEFAULT_SIZE)
diff --git a/avatar/settings.py b/avatar/settings.py
index 12d5db2..8f696dd 100644
--- a/avatar/settings.py
+++ b/avatar/settings.py
@@ -24,3 +24,4 @@ AVATAR_ALLOWED_FILE_EXTS = getattr(settings, 'AVATAR_ALLOWED_FILE_EXTS', None)
 AVATAR_CACHE_TIMEOUT = getattr(settings, 'AVATAR_CACHE_TIMEOUT', 60 * 60)
 AVATAR_STORAGE = getattr(settings, 'AVATAR_STORAGE', settings.DEFAULT_FILE_STORAGE)
 AVATAR_CLEANUP_DELETED = getattr(settings, 'AVATAR_CLEANUP_DELETED', False)
+AVATAR_ALLOWED_MIMETYPES = getattr(settings, 'AVATAR_ALLOWED_MIMETYPES', [])
diff --git a/avatar/testdata/test.tiff b/avatar/testdata/test.tiff
new file mode 100644
index 0000000000000000000000000000000000000000..c3d899b6075a966450900a7726c3886170f73a6f
GIT binary patch
literal 16358
zcmb`O1$b4*+Wq&5lLQF~9yxJ$IdOM`Bt%FcLfkz8f)puUtVoMnDNb7oRB20Tp)JJ;
zZp8})Dpc>i>%V575NL1j{r=DQd}$YZ&bBkZS?|0vd$N;~A~{Ktv%h3MWx1p+Ns@y9
zw@q2qU7k48UeXl%b;2cSfh6g&tmWb5?Xf^p(qP$yho&#k>Mk!|s8FAy(9o0?YINUc
z=OTrqFYd$t_bz(2fBzz_?){%H((XS0=ptS9_liA>dUTZsvaH{IPUqUE_3`xZSgYtd
zhu^SPL()=zm*l@zv%BoRzE}6PSJwCLF5h0?r|Vi0tsn5Lyg_|`g=m0{Pwy|v8eQjz
zvgUJTt?qk1+^F;1ex=+#mSq2#mxv$MQtD0hqO`p{JiP-wRDquUN-q|?1HFBvzuU)i
zWiPm$Kq;w$t}Qq6J)eGF#?ShaR#haoo|3ke7q<aj=P1g2N2|&_M|*jec$WltmzEWK
zdwTf!`1_Z6d3gH;cza3>InfAmHbYx}B8EqKA;5kBmb_4dM;8y{#~Y{d!}XK+@tZR&
z3!TPKx6b3IJD2d}Z}iihi}>mGg>L;Q&b@UG-(UY4kFOrW<7<cU=*nk!bXn*i9$q?t
zhZjG_!}I&`-P!l>pz~ckIQ<U3J^eQBo!pJPC*Gpoz?~C2sBLN;-;CSGHsRLM*Qj;4
zd2}_k5;wo5j;_GXW3S-G(WSU?Yzb~0UyS+@F&Gi+k6CqjNQ>}BfUOCZzEFopm%hM{
zH#^C8mR#q$)G60jaQv0;r@K#?1tYlxC;6Vpd`HOlnauc<?a`%A*@mCs;f0Uz-T4pk
z;4InByhFadxPN*NzC9%v$#-%WwUgRGZI^ZD#1^t{!tLW5skOLud^K(zTg5GPVkNbl
zdIh&mE=6NrB1$tNF}FD%!@|AcZ`%h;C)bkiOER6s_vHIQmS7~S@Z|Qt^Zl8(%SW<3
zxy5^2|B~Ky@m)E{dmkVheY+q;@6NsdCqCidQ@(pA-yo-8+<|+iwsE_)OPg`$<m=Q1
z+&;OET1%~=R^j%k71XQLD`+cBg^#NPYDXj^J;DnrO9Q+*tr5T6IEmlCy@Frq)vtFi
z<Ci;^@iRU7nLhn|_X?hHpNP{RZ(XD=sJG9@rtpw#Kixb-wlAp9yZobX-F#%b@WFF@
z`_$gae7ni@rdp@CJ++G><LT`(=e<)~aQD<^Y7_39+CZ(N)>5l+=k!Wy1+^UGO4Gp3
z3U5bKBnLSn#CZ^29$$@<AMeJQL;G?0>w~y)=1bhWcpML}s{7wB<o@mcRs8Yb8YQ+@
z@w=>R_?`QI<MChau^sM+`0T{@U3`zOe2#~gKV_d2arrUXK4fgF`R=pt-DiA$%lQ2E
z)Nbl6a=gjy8x*&vxjns$+DYx8wvlxU^*R|}!`;&xsCCp@YBlbj5n6$1wK>q!k&qhf
zhNJ)|BnCQSQbi_m;**dVnTAoB`KTx=M{8X(rjDD41v6)2)#8`2Wz9;wz2!CR-@P4&
zKG=if2j9o}BL{Hp)EBsO?rYq?d>oIionrqz#T<1QKixQlC*K^#lj{fZ<l3kB;mQH>
zJ&Vozon$++kJ`&R3qIi)CAiLzi@Ja24NCBB=jW}m?w#Jub2j1LnGMu>S$EH@;dV9d
zb*{p!hCKLK_eIOdcnoKJ2058x*`#Vrs?3M0(hKnc5s31QLWFNL!hB*8>K%_T-(-aO
z4@E>s24W&}kery0%=9wk=hdRBtOaci9hlrP1#@4VgJtty#`<MTuw(slyt8c`4(#5D
zFW=jOOJBatJ}CG^-eg=-f=%W-!~7x`Pt(KG^zO`?Jl-Yp-9IDvwo#kA^g6e%;oHuQ
z6gfM|N49&Nt1+WK4+Tj<STm&(*>NgZGgdb*nus@6&Sl)%BHBL`aeje_Qw5VXg#Lyi
zF(?8FA<;+-jYU#uJd(o`kra`Nq{wu7o{spaOvFWvKumNVm5;c%Qp6`#B4ua|GP4>n
zvS1v_D<<H``>)}LOCK<Al27(daFVf;e4TG|-)`zH?t6o6@Fpd;JGf6sFm9m)o6sg+
zqh`F<xsK)4`1b5-%xW5ij*?;6GN&2CV^mO*Z_~mFIJJK#+?)g8?W{tiw?D$&y%FZ-
zg)k3q`E!&{5VtBs`2^D65Jag$WkvgkAvQ1qapX@3i$`L35|X1*kP<x<sWBNyjmt(>
zdJ$ZFhhy=KF?f7|<AUrT#|5(8KTDkx+dcgJHjlkU3AUYo5g9wTQ(LG_)N5T59+L0u
z8kz5<_R%QMjKzlOjmU`$f~|psb#uqDJr1I#a1@Lr3q<><kQ5SytR(sq8ii1@Mtb>E
zDnxJ_?j48-pJ26ox%CT0q+b}f;fPd4P~7^5BZ3O&zPPYhI6J7&QJc@P{ayTUbw9`Y
z5AgWXhs>?-GylBHyt9vE2KmnJ=GZS7g?G<0Zs#$ftzC?p*(T&XD?D6J3BEO0JibiM
zpEK)6qA)caedyoH>8<$r`Z27YKV3eS8XAV2m?Vr&&qYb@Xr#p^B7|N>c&ZRizA*Y2
zLB>d#F^GLNgdCw=5}XwMjUZ<@d7~KL-tIvt$V|rPyB6a72TO4KD~?x3IhKhrfIQ!w
zdm9g_?_|C=@m=RGneV%^JGqaXXLoe*ZIc-voZZar>-3&Jp4~vUwfOej8Z75nF2;x2
z>{w*Q2FT@kV=D05&6D`-?alJ%w8%K*MkOLUED9qtMxZcj6jCGO5$x(l|GGRRXM}eU
zy;LjACxm%OC>Y_sWEGN`!^jwh5PBIE6pU?CM&ii&YJ9OQ7GJE)#HSmI@WqaL=Fctk
zmVD>PcJ_@f?RvI7w}WNjpWqWB-?`T*;o(M^@je+>Os$t0R4z7%QMt(F7pila$B*Lr
z@dJqVa7MIu016V*Fx+4CGuEFuXJ||!`yRcMePoP!uq=BSz-<71?c$`bVeG5n^j6Iq
ziZF6U1cbrG(FY%{YQVJ*Cgbb1dAR<`0@iCgF6^tOU)wlF?xBZobxCjvJ|TK|PKb=>
zp8BU|dm#Jw)Wg+S^<sm}<nLmOq(Be3JfR{BKV0Vg?D`3euP%n2Gyp}ZX~^~uMruen
zyqsNFR}~V1BM{>1!JOmE{KHsf?g{tuQ*(Nei=3g}ew05Ih*0LD5V8i7H7Xz!N?R4y
zOiae9&7*K+V+O8%G6&yZ-6Qke`f4E_U0{r!XROL1-#M}gu5Lbc|9fzDi#j&h|DN|x
z^uM(;8)c>-S6d|dyUFE=RXM!(A^d*t9JamslDsc3AsM;hjL$gc!^l{8J2@aGke+yY
zBh<}P&a0vBBER}@p9-O#{s`eVgr0`d{}6J9$lE{!lQkwV3<E9w@N#Pk&h9A3(M`Fy
zx_>(7*K2Y1trDExGZHtyTE;PwF?xZF7v3Z*<5Xr8zHRT)R&{K$?>!KFa*o-+I9N}u
z!TQ-Pa{av>tr70&B$uaDjKHJwpOf!Aj=sMWwvslIgG0%dfDvKQC``-2h~zY6CZ({y
zd9fe5BiO@JRtP-|rb0aZ5KO*c@(D(vV3{vK<`e#zTB|U*A|7XURN%zs0(^5|9=_uo
z<lLSLoPN6iXWwm>{d#zbK9cd_d3t!h%R@Of1ta;+sdLK%=1z6r6a7!kw|VXuB&s}+
z7Z-x@B{|3p@WM-#Bk}m$LHu(26z8j-pkQb`T>6<IUFDBVjupA#WK7LKQT9lV34ZW*
zaN*Vmp<W&cbR{o66pX<heh4CG5OYwFmk;GjUiwFcvoAY32ca%E3dc7W<K&h++&H*^
zd>hDDE%SBmtCKx?bcy}&qVSOZb@K_fZE8L_chWn~Uxd_*>o{(##^lm$6eotEAUXgo
zImu`o9*-5``S!wRoHriFkJrA&{7KESukl`<80z4NypRx#jEcdiVVPv`KzvXTMhzW?
zw8$s~yLljpaT@II!DGG%5+YZiC;4Pg{rQ>s$S)Y~PAXm(g>&!E#>IErar4j;=9SlQ
z@x5l8p?}vupTjYc-jVI$MG>F7m}`VYZV_x<d{6xoY;2$VoTJ@8EBIESFg6gSNg>FO
z^+Q2?01Bi0uySH0e!ReW@HfZt&%0;v$@Wz;U$n{>5l+q=N8*ti8;8_@K=|1^U}#h{
zYKn?clr;iD<O^WD3dTVC800P(RV>p-N^Ap}Yek;%cJbvrM};e2ZO4z7-jT<+#}{_s
z`hh9v+*gcyC)VKcW#Jv!s7LI7GUNHD{ckH7x5#?HIgIR`%*WX5<oI`HC7N=Q&^{^^
zO(T-fn45x{tOSfJ&cqu_r{ewf^Kf9xGQ2+T1^Ad*BE-doYZ*=ma&cy^WPfvZMSznN
z`=BpIj~Ip0yh6@Zf}j%n$rr$Rj!+;O)$-$KA4>SCLICrO{SYf0-M<dM-RAS*rG5DE
z>f7{j9^*5Y`DHQrgnwjXei3|X#vSyK-f`~o9dqY*a(s&Unea~dCZy(@Iy?~dkuGS8
z^+IEuH|i4oQI{NoO0HStg?hohpDuJb{s%kT^V!gud}MT@9J|V{u24BTVrX<M`3jI8
zmk3`+Co*`#pLw-gGOuqpUjWCGP~RZNg$efWd>Oyq`jmWoI9J=F=G#32HxA8zj!(^|
zW@L^z&;HlNCip~L-{-vS{+YGZ8frDQ5}T@GFgel`Gvbt(9%qIb@k%Vo^1||>Xe<~N
zjaj*ocrhm&qe4C4Yfnac7%Y6Ghk;}bWI2HHr)Lp<oXb%DE^g#<r##@#@li-6vwCqK
z*FfBvlid6`j|q|Ee*3EF^zSgfzw$2q+lQNn=dk}}al3$gyE#U@iO0gb3%k0slX0pZ
z+rQ(u@SPYJ$oD|zBO9M@Ws&dQv5DB2>xeD+F4$J!hON}LA|LFm2*aDTQB*AUG$i1q
z>=3xxI&!|^#__<Fd}_8pa>{)C>_=by$SJr~JkO8)P{p#?`f@HO7*%dQlrPWWoPf_=
zl4OGg;|uZl1fP{S)_s5JEppAp*?sxA`Ne#E&-i@I{PI}DC-di1#)tGz9i#M4jD3QS
zW6S;1f^Vhl-M3ty`0Ry5yj|>yePyoru+9@7)>DlteAFI>{jFj6ur&e)$Hrk_Qw-7r
zyrH5u;qI=SU%N4vP-G3H0$Be*;hDQ&q6C}p%|+~EU*vcpKKltyjv*@g80HrM9Zg$|
ztI5PeKGXepc`tJX*BHKj5$E46k^TFD`SUTkgdQ<}J~}VFqr~_w$0z-h$At}Q|LEPf
zTzgULRUDcSjdzM2@o}9y4z+pU^A<N8o)Czyr>Ef9taKckosKVG9E#7UrlB=Gf_)|c
zi2;1>^X6R4)059i9NVcNjt2p5<dj7&a`=h9NhV*)!-0L$gX;s#MgGh=eq;>s34n#E
zBMLL)aPRBQ`2FSw_?~m*Z}vCf)Enu1rdWg@uD!!PxtHr1dl|oEWxPJVL@zH2PLX4t
z@`<s5&wZ!(+<tO7*EW{3{0hFF5{}Or-S9=5C%$a=!l7nYd^I5yS5}qb(BcMcoYIO{
z##V9tB9(J4C)U-K&vJfz4h%tZXei<X0}$=!$MM~la}?%OPmX^a69brEMQjQ`y_j>g
zdgwvhuqTF?n!%TT`iXu>dAqWWd_A#iRuMYin~!fkn1xGkmSNvC51d|-iEsCG;PyLH
zar?uWxbw+;-2Hqp?tQf!_qnF~;KV9CAkPElk_XHy5BSXYfMec+&K1;hS!ZTO;Mh1X
z934kK`uAzABaTc6!|kp0_-JtpTC18ccg$GKAKQ+J)fLE3OXK|52iBIBaC36xGph=T
zVPQz3;)8<_<uAr=Up_PVa18KbTZre45cW+cdhHC$f&Jk^FZ~&>g3*txp3ZJqI5r<!
z=ayj0%tE}muoxT1r($1=4^F($4`*MHaDI}6Gh-y2>d?fQDHb^Wq6<#W2*imw(Kxj@
z1)VFiac*M)E^IBs#W!kjWnUw%f7p)B>0vlZ@4jks!B_O|Xp1w>&5FRIH|ucd)fSAY
zsK?|ws=fg;+uAXAYzJnxwxX@P4B5#k@MIhgF;&9Nfny@)Z;4?Mvf_e65Y72_R6sDI
z`OFa=5P+=65Tu0$!jp6J0M6G`Vr=yGfxVqG<}_#Ft;IFizMuwMUaG+BbBgiWoFZ(V
zQ;6L!<zoN*bR3=^OHadbX}Jp5RyyO#G9@}^8{p(L3CAW%_<9`GA>k|P$at0~NVqUJ
z3@19=aB{38K5g;DiqV1C+!&AdX6NIzDK!{h(}YR24d|$@$2dxSp4`}mS@d*X#{^7o
zX+=ZPXr#u*!j}29cmE-9wsS?Oiq8n4T!*3J`TQRh90nie*a&YAwnG47!((J$12}i{
zW?n5D9*yaB8CcShhqY7lv6((@n^lM{vqxhSwUP0=k)OBD&ByMAxj3+L1Ws<s#x?fS
zd+$<v5^!^87_Myzz~xQ8xU}9A7gsss>Y^~5o9>CL(_Qd!lLyzm_?(cDi0a%7j42z9
zN%XFxx)$TAYB08{nyRJhWp&gvU`kUfW{(|*IUVCLwYdp3`2~oNh`?Y|3uyKkKxU2~
zT)&75kA)}aEf(fxh@!92L0qHZGg1iimB=~iF@Y!?7K(ylAt)Ih#x<`b%x%oTvW^_C
z?Ty5SX}MTWt(!Iy>s}Pf$9n3u8F|<|i}S6yX*j$p4HtF{#W!yy;QE^}xV9?_m*)oH
z(hN7;obAN?>57q@kCqRQMO#5SCRUbk4X7S%m9=OoukKPUTFYzE#<*>-Y^0jx?YNp|
zvbJOPnDLlBt^+SLG@v{;50OD3=+)N<JuO^d?j8;cdmlt_jVhXcM(`Oaf{da5fk=x9
zK}A*+iqk_;lpe-49zP6=_C<Dr3JoKpuw+aoHqXe%x~X|sHZBt{)+C@hClD!N?r^lR
zV_)}1ZC)zow~~442y||a#W%aDc`96=>y4XpTyePF6}d41C>j=p#*xXWqK6gvqtRSm
zho<s+G?dn&zPK87B~>ifuv{gpjht=FLv3VjWqE8Z*ScHAV$Qfp^tJ;N83V=HIS37o
zf~I8vv>YSg;KsE_&f!A2rW(OENQ&UN!};LwSYO6!D4GjmFs(Wn3tG~!pg9dQYm(4f
z5Q$MKDz5!_B8|@hg{cv!&rQPEVtP@Y#cc-4veWs@H4G=#Md1edZY~PM)ww>nK7;vX
z4E>At$H?SJ)NsC?63+ErD_h1}Eb_DRQ8l^}H6_)k9$keRmMaU(k(ZInc+NxV$YL~<
z(buX*v{22J4RY=sSJy_?4$K-m0W;d$IhNOAbapO+*#{+^-kiU1%rLixw}%^A@?$Zt
zAq_9L4ab7k3{0y@M$4#3l%|L988jS~nF(kuOvCu{Y)s%Yct=?d+KPswe&jGz<qTz=
zQyJT-m|dTO3tJeQTf=c>mNza=bHcS5_Bb}d1%-@>;jv*DJuHU#-WPUC3s{&9frW(<
zfn0yd7@CEWQKhIXsziBF70U9<P>@rAtYO*6NaizdP9Yk}*;LU$Mm1{-`)g};BgQqf
zU~1b~%w}GiL0`v`byRu=e}CmF&qFIRLovBB70vk~_To{Sn=03TVr4ESR^+0iGzYEZ
zsii*^St%%^%CnMLPNb5_mxBCZsaVpIg7dG(<LIklxH#2?eD=6G&lMMD`JyD+2PqMO
z$cyJXt*<-W?Cjv-=mG~@8<-9mfI$NX!-L~?Vr(i#W{*Z`VHGNhYsgxG(RrgWa(Ev7
ztwcRzxuL8MjTLqDvq2rd)r?`Py`}{d8pmLo=&K!*=xqnu%8Joakb&_PdGsfT@s^9R
zB_rg0f~PV&8RbIcsN{3F_$-*pG7}lk3H%)<8R>6sN)pzNOGM|oIP9Jtii^xGS6}kP
zz2*M6I$wo~Xg9=$_#r!rYeHVmaIv+9Gv!D=AzN!Jn3)biKNDlv+SntKYw+2_^HGvt
zPR?p_($~UDRIyxJQj0p7v0fdoGFvmo)V8vZ3bkNdT?<}l9*4<I++UoHrh+s%-l`dE
zRpbz=9x;^L6jXFE<t0TSKQ)?ho4{NV$GjWM_>DzzS{yPH;<0LMEUs;h#JYBOTwmye
zn@d%=L%vJ%yignK%zWmBVWHx=)B!GbV(hkqqn!=xY^=#A7;RzAt*NOgjEwZTHD~OG
zA$@2z3PzQobTm1cdn%}E_SbqcHZk8ei#V-nMjQPbBeS)VPl&&Bs$!qc8^+j6VSY$O
z4OPu@6=SX<J4yCQcvM0qu>G^xhYC_-kee8Z5mZhBw+Ru*ii<$i$VjZ26p7|+_PhDM
zxW336x0d<f#zHT&#Jj-D)1ANT^pyEr9jwS_%N%S4J8LCut*l^UWdln~Ygk#@Q1p}i
z)5y3l1`RfaFXzldlQU5`svPAdb*P}KO6yR^{M%T;yu;knR^8<x*~U^G4ee+rUmf#A
zZLY`@^o#yg(zEicB$N(M<hY^ssvtFvJW=E!OMEyo<3f=Z9fE{Vu0?vga&BaelAHik
z7cwu62*SB(uDH2`9xm{}+x5;E9>Cw>^1OI|t`BiO?c;0%7qU4qE*)$vVP|CtTh2Xg
z$Y*I`&GA|ZC3BCZ(u!LP^y}Xbefsu=vy&GRV$=9L!BSL^uco|#j16e0Y(_Kr+8Cc>
zYTKUiRaDB}3EyNk(bw3wN@T8h#$yadCaJy3ijTmss6ehSa}Cm)eaPNY&JFsUzgt=K
zM`4B^=NTa=Bj=5U?l?cg9g9XdLh5hE^=KPD`#AG=C9YhH=G=pyy&Y}gVQ&KmOAGQ@
zsri^!t(BHAH@AQ}<I}>7GB+oqCAlpzV1NmF_U;KAYX?L}Bp@%R2$iK|tm1r*V`Y=@
zQN*e6uf7fKWu^2@^fh%q6P}G`e-be$`kU}8gFeM`Ju1-C4bC<e7&M?CdiCxFqdvVb
zWPmXSv2Fc5tWcDpLUEP~h3P&xJl+*`(RPrGm2g%L;Ip|E*D)O_C$6tMGDdB=uIC7M
zdn;I*4}p^ND<zpMEzD$z`IedKVD`Zwa(^`C^N+ci1(fvDQfb4O9gLoR`mlX15W?|&
zM0O#n%Nx;H(~4H|iCj94d@ZG;QJu{kNZ$lo0dq!fax{j=g>$~nT<7BkCmVD0H|YaC
zLtPm5GGLDDgTVt$U^civpCkLjbWneuXTveVNA_^!P){UySwk9R&NU)a*qWNa$ARl)
z<PmIP+=h5Ka9+&ZVrdGc*+7^N78*>y#Ah>kY&17FmHVJz6uDLSXl|zDmJ+ecST-Yb
zPqwwONq_k9cS@P*d8jGlxWVzigJVT=G5zJ*oyZ@#^ect)8JWq}68-xbLq}f+`i4DV
zY}}hZ^~GTNHDr(pEQScS0dn2!l!FixWRJX5FEV;_jopL&XfW3>hrr2l5G)26!_CH&
z>kf8&CU>ChxmIKYH(LwFCVev<h#`D_8%zyhTbYs7bjV=YKl3g&!Dmi(bF!OtNyM-P
z`=%B9u2N|Z6OJuLMt$M#=7WsXOf)k0)D`6OorX~UUc#IC%!&-gFd&b<p&pEldSYNd
zBbiBX4dyWskEX1zkOloya%{F^`~`Sf^7n4GeD1X2?{h5SX(QMM!=CJ>1N+M5KsOsc
zTie3V#Ts7p)5Fdh_7<jWE1pB9!DJJBg9i=55PE4U#IeFm7Cj`N8T+H)GiB_Wi@r(!
z#6EM8kCY-WS<#Dr^1Q{--WmRU79PNOlQcD<siTdaJ@wJIPfzqU>cwqu81*(ppWX(P
zA$s?EDg*hvUOf%ai{~4%J+yW8z*h`;UoBbAR)feikbLxFKwmg0hmgyLdDDt(CYEru
zv*a=Q!8Q_Y+TX;8ac|VUH8D1V3CD)M%$a@r_MupxzO0Xt5&E!Ry_sW#da+KudK$uz
z622H1=yQK>*562G6u)ED*3m&v9uqRq*Fz6|UFdUNL#Rg&mbp);2W4O&&QYHy?j>Z%
zeS)<&`=)3MBTB@jBYm|qXB^Y(!TpUez_=Go7!%@nub#Y@i2WWq(9_j|?w_Q|&zjKD
z;eH*lRhM;iG`h+>E+5l^j;@A$t$YtXE$C6Yy4ujy6JCirk=>xH{(?ntb@7P(24odX
zhBAwuyfrjbGs#;+1KB@y`>4GXemc@S2l82)^`l27G811<gr=qj_+BV9wIsRzqV9r0
z=F?+c_0())tH(MDsmogE!E%ot>V0Crx-6JPSw}5B^;S<lPaG4Ub)OxV{Su!AE7^pX
zY-gEM_$PZPI0f@_63jBU`j{jQ<_nzacQO6>;^otKL)}?czZ=T;PhHyh;;8x@o~(HK
zJ}BQYRrHeI2jyEOE)x~K<uX_ET~;gl$mM=4Z&VmPeQ#A`fTHhn_vzPF<~Jz%ca_EW
z4tRRLqf#;W>3gUy?<t0Kmk%gRpSzDkS6S4@Q~qAQ+w1bB!b>jmy<V4-ilFZOw-xEn
zU7I171>-}F55#+?I()a(<>#sI%kTcyNs_n6jLN6=k@RLXi~WZ2+`pP#N|N-{|0)0b
zj}%o@S6`?8S2?V{y|gK#qP|5L=c&w*r2a4PKFVj?VU@*2%|+5*-<wqhdizUHkFlom
zf5Bq{$J92|mbMfr$JEx;H3yCfu_`L5A6**Ave@lzrIb%;sSdHqNg1Y$s&6V)`nq|#
zd0B<(v(mv$C1ru>(Xm~Z^HYdbMN3OVpu2l}d%Ih^w_ANvxw~gTK!Cf4m%EpjE6;Fk
z9$VK^G{&{A*;;**r}v32Z7y!AY-p*huTzTq7LBfNZ3(fm5?|E)qpoLBD{I>IMRm<?
za-H3Z>ucRh$5fWNd%AhJ^9=Xy+w<yR?g&gSt!qxGE2|In^!0T2^iX=UQoc$LcMqXp
zam}++o_%ZgrM%3|)78(z%|}^V`|NbNCDav^PmQf9YOaW?uWjJB6$zS94|h-X>HmJ{
zFJBW|*;LzJ)KnV!w4lr?ZE6-RLa44PK0WmGdxPCYYdzO`-3R`%|9@)LlH%@0ZD?((
zk-aM^b}y|dtu3u<X=b~6{<%#{iUW(AN{d?Ro1T7US2Kt&&M0mC^IqYCI8aj=st!bT
z#rg4BBZzZkoIhV3?Ebf370kUQ&!Xlp_YvO}QPcA0z0WEkVm7d*sIEN3YK&`1X;~2`
zoK~S~fdBaKf2;DJze}$2-&amlyQ#9gqNVxIb(34?&v#K*q^sHfw#M#%xrf|(f4+%a
zl|O&s|5?m1e{=`UpL*h$q6WDm{;3o4?7%1yF{RNI--z(^cJ)xXdioE4`o4d#`(Ms^
z78}9hNJ@Q4W!c!jyIN#8_0`Xv^OvjB*&pl5L)nqUy}CaA<s7+w^-aU;>ub8>w7X7S
z`@1grKWoJX=JWdIiu(W1mfeT{y+ykZ1&TINw{6MaH|*b^`d?AhfK2eA`fReNgGH#m
zWU9!OG>6#6nR3+BkTgs+hDkc=PHn0YD(MMhJyf3lrW#?A4*y8T+uPSvV~k|+AN!U1
zfT@P+`D=rpUMt4T<jT5w4ZgovTi4Q*9v7+18Ih~hJ<2cdA?ffhJEWrG=7yAv*x?)v
zrG%I$Wiw9_<!3)XcZv~Ol1{nC4^t|i?f?HO85K7)wQz<ojAwg`Zq4#EmTTHu8pQs`
zESrq37G(|22PBgwR*+@>rH*7$t}eUC=cvo!qFhp2SHg2dof}GOOGNn~%QM?rOIg-T
zW_fyBWobLhr&+eCX|1hf`B#=rYD<fn`IulR_P3N4SBO7HV%e~1czP7e!JJ$emOob>
z{am@FbPVe$Nm2C;W97V{bSQRIa+vm4#+SC&l(w|E4l63IE@~>_h+o@KR5w<V)Xd^4
zsjp~TB^%k#Gr*6(s&!-YcmMp?gWYHS_k!?Nea4SzvS*6^N1p9_cI~r$_3I_c{|Vb>
z!Lxm%UzMbNFG|wD3(xl1tmU5@O_QX($DZTqFXH97X-j2kv72bn?w|khgzhu{bK$w~
za}(d!-FC`o_1L2njapn^Q{UR8Y;GtjE>*hzHHiP$7d}_5=j!2-URqY#R9eTc%3_o;
zGt%z5l1h07R$2F-9R6Qk_FNrAQ61MT7;pTSWK!TJ^*LrDX?}M^(lR!XG)Id0v7+0z
z<Q`d)=y}-|chqsuGLOsu{^=i$`TVHSTv@IZyQ9*FD~ns3+C-UsLj0r6zXt2gzt$Th
znM>A^gXAiCNh&Ew3YTJ}L}{orTpA(eOT|)!R4X+}?b3K@vNT<q!$0|3A}yEJNE@Xs
z(oX3uX`l3g^ojJj^p$j6IwM__u1U9~`_g0SXXy`xLZPeZsW4UyQdlT#70wDTg})+H
z5u->}q$@@!3KivwIz_8uyke?ij$)BwxniASi{eeiyNXW~Unou}&MU4f?kRpy{H~#?
zVW?rEVWwfH;jZDY5uuT!F<fJmM!80##yE{>8uK(>(O9psU1P7tCmLUAoYA<ZabM#J
zAG8cK`)gWix@!7sMrjV!%+)N@Y|@;lIa_n7=6cPYn(t{I(mbVkP4j`~Z(2H9##%}(
zSFIqec&$vWVy#B4iCS~DmTPU++N*U?>y*}Yt;bsb((b8ks_m>DsGXplqg}4uu036Q
zsrDxAJ=&jXpV7Xh{j-jaPJbPH9hFYJ&Ip|<oerJ3I;(Vc>3pnnLg$9g6J1^1LAuVm
zA-Y3#i*#Fbr|Z6|yIuDq-IKbvbbr+|(6i9<(u>v0)vME+qPJ9UtKNRSlX`db{^-%C
zhi#9*9z%PS^cdS?evgek-s^F!$E_ZJ=o{(V>xbwM*RRr_tpAGsPW{jHFX{hiU|?Wn
z5MYpIP-*aj!7B!D7#udZZt$C7UqdIuD8rG4t%maqUpM^N@Vw!VJ$v@F>lxlNw`WVw
zc|EuE{Iutlp1<}o?&a1ip;t+-NxfF|+S}`7uZO*R^tSCC(L2BQxZX>9@9ur9_k%t?
z`q=e}>QmHbVxJX#-tBX?&l4kKBTu8DMzuzBjkX$nVRW~zZeP2;F?~z=PV2j&@27ol
z7;73^8%G%z8&5UfX#AP+EfXCRdy@o{Dw8=TJ4}w6Jnq-GpHIK6eq;Kr==Wj2YyCC*
z+x1WAU(<hn|F`;g_Wyl=*?@=vr2}RS*g4?jfL{g<85lmWbl~iPy9S;a`1>H`pqN3`
zgBA|jH|X+Ut-(%%(+0N>UOo7;!4HO*3<(-iJY@Eew}xCW)i8B3O*ic@-C%me^og0d
zS)5se*{f!snmsV@Zys)5Wxm*azxh22V~bFWN{hu7A6a~>?5B)S)+k?59#lTIG_{Pk
zY_(ixdDQX`D|@R<t0`8ytS(#YTl-s=SueIeVEx#}!Y0LLyv;V73${IM{cS63m)Rb&
z{l(7SF57N~-9Ed!_5<w`?8n(}v%lof(;>{E(P6#AX-6GLf5&RaRgTA<G@N{$Dx6k0
z9dp)j_H(XuUgdnkMcXC7rOsu&%UM@L*9g}(*KMxX-TJ#FyG?Q1=l0Ou#y!`4q5C2C
ze|h+N)Oc+4xair}GtqO3=X;(%csY3$d#&&~?cLKm)_aooJKo>>IQx|PtoAwQYwVli
zJHz*Y??3%ieocNm{qCu3RE4UQs<Zwk{=@v|`X3I^4u}kx6!1a7Z-IV+ErD+ZJ_>RT
zst(#3bT`;OxHNcU@Qo0wkfM-vA=g5cp@pGqL$8Hdh82aa5BnzEI=m!&Q}~?-$B3$k
z?GX<nJtCVT_eA~@6&N)k>f>n5=(y<F(MMzY#$?7UkGT?S6<Z#=E%tGoZ(K**$MM?n
zN%0Hg&nB296eny+c$}z8oRD}h$uKD+X?fB&$xg{l$?v6Tq$H-ioN_7EHnlEw-%x32
z!qAt8ULIyYtZ~@;X*y}c(pIG1PWMb7pMEIAIHMqAYsSyRBZto)elgP_vo-TTR`0Bl
zSzEGx$&SumlzlD7J!eABS0e_Gs2uT5u5NBt?xx%)c`<oQ@@|dv9XWku=P3J8V@7?E
zKRCZ8|HFdb1w{qB3$+Wg3%3^jqiAT+`l2VJ6GpEb{kS-)cv<oNlJJtnCHG20N*9&h
zDGMoERCc#Kr2OUbdlg|7ODi5!MpZ7a{Jtu_YE9KI)kCXauSQLF&8}L#+QQm*>-yGJ
z*Bz`kuOCx?qQSXgdc(EGz{VwwkDHR3HZ?1nM>W6GV#3MPkyeM+7hA8lg|@9|`?Wo*
zefJonF?C~(jCC42YwVqIvEyFr(CR4eI56IF{N(Z1CqztGH&HQh^uz;`tS3#IbnAt<
z7dB7UpIklp>nR>n7ESqSYWCFkrkPE9VcLxs<6hi0z1Q@n>1SsI%~&&2Yi8xlqqDqc
zy*le(vrA@wImctp(mDT_TRiv6mpos3<t5B3n|E}+-~81JbQaVt=v)}KaPuOgMdKFT
zcsb?ey^EELXD|L~Nx_mYmijDRvrK<k>#}RFB){^`t2VDLc=aF4E0&*G5xHX5O4F6I
zR{pZ8WYx*l;j4G9F<Ucd&F^a~*PdG!w{GuxyY)*q=xk`)aC>9c#zU|9zqV!5;7xNj
z{qyy@*RO3(-+XY3YRi_brd#K4)7aL!?cVm0+mG*v-to>(*PZKj_1`t;4e5>6H@<zd
z@XgM*lHNM7+kf}Yw{72ExyN|V?7fP;WA{GZSF!KfJ0spX@owU~2i^;MZ_oQ~@4x<m
z<p(Q1?DygP{rdZ-?Z-#sK6>(T!^aOkDgWfgfr0}UKh62{^ue@)M?XvY?C|HYpMQEN
z;?PHjLk@rNMc^0je(C?^zOVeg+Iz(J$eyo#zut4y@95rRs$=gQ4><nbiQp6aPllcR
z<W%&j&rc_u{_0HXnG>Cvo#)PuJbUe2$+^4dYtDavq3yyS7hkxfeQEaPK9`qXF}<?>
zs^isN*Zi)1cs=_1k#91-xp<@a#{HYkH~(>K+U=gVm)^0sv*oVW-4E`?-aGzn-nX~z
zH{Ac@!SwHpzFYaw;o;kl!XF)Zob&kB_f6m9hq*rv`tkLje11CcWZ07{KiB^J$1k&g
l9rWww-~4|&^n3R2cm8PqhweXK`KRMQ-}_h6zb>H`_<uy2ysiKM

literal 0
HcmV?d00001

diff --git a/avatar/tests.py b/avatar/tests.py
index 6d233d8..c3d29e2 100644
--- a/avatar/tests.py
+++ b/avatar/tests.py
@@ -13,7 +13,7 @@ try:
     dir(Image) # Placate PyFlakes
 except ImportError:
     import Image
-    
+
 
 def upload_helper(o, filename):
     f = open(os.path.join(o.testdatapath, filename), "rb")
@@ -24,7 +24,7 @@ def upload_helper(o, filename):
     return response
 
 class AvatarUploadTests(TestCase):
-    
+
     def setUp(self):
         self.testdatapath = os.path.join(os.path.dirname(__file__), "testdata")
         self.user = User.objects.create_user('test', 'lennon@thebeatles.com', 'testpassword')
@@ -36,7 +36,7 @@ class AvatarUploadTests(TestCase):
         response = upload_helper(self, "nonimagefile")
         self.failUnlessEqual(response.status_code, 200)
         self.failIfEqual(response.context['upload_avatar_form'].errors, {})
-        
+
     def testNormalImageUpload(self):
         response = upload_helper(self, "test.png")
         self.failUnlessEqual(response.status_code, 200)
@@ -44,28 +44,35 @@ class AvatarUploadTests(TestCase):
         self.failUnlessEqual(response.context['upload_avatar_form'].errors, {})
         avatar = get_primary_avatar(self.user)
         self.failIfEqual(avatar, None)
-        
+
+    def testUnsupportedImageFormatUpload(self):
+        """ Check with python-magic that we detect corrupted / unapprovd image files correctly """
+        response = upload_helper(self, "test.tiff")
+        self.failUnlessEqual(response.status_code, 200)
+        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked
+        self.failIfEqual(response.context['upload_avatar_form'].errors, {})
+
     def testImageWithoutExtension(self):
         # use with AVATAR_ALLOWED_FILE_EXTS = ('.jpg', '.png')
         response = upload_helper(self, "imagefilewithoutext")
         self.failUnlessEqual(response.status_code, 200)
-        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked        
+        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked
         self.failIfEqual(response.context['upload_avatar_form'].errors, {})
-        
+
     def testImageWithWrongExtension(self):
         # use with AVATAR_ALLOWED_FILE_EXTS = ('.jpg', '.png')
         response = upload_helper(self, "imagefilewithwrongext.ogg")
         self.failUnlessEqual(response.status_code, 200)
-        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked        
+        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked
         self.failIfEqual(response.context['upload_avatar_form'].errors, {})
-        
+
     def testImageTooBig(self):
         # use with AVATAR_MAX_SIZE = 1024 * 1024
         response = upload_helper(self, "testbig.png")
         self.failUnlessEqual(response.status_code, 200)
-        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked        
+        self.failUnlessEqual(len(response.redirect_chain), 0) # Redirect only if it worked
         self.failIfEqual(response.context['upload_avatar_form'].errors, {})
-    
+
     def testDefaultUrl(self):
         response = self.client.get(reverse('avatar_render_primary', kwargs={
             'user': self.user.username,
@@ -81,13 +88,13 @@ class AvatarUploadTests(TestCase):
     def testNonExistingUser(self):
         a = get_primary_avatar("nonexistinguser")
         self.failUnlessEqual(a, None)
-        
+
     def testThereCanBeOnlyOnePrimaryAvatar(self):
         for i in range(1, 10):
             self.testNormalImageUpload()
         count = Avatar.objects.filter(user=self.user, primary=True).count()
         self.failUnlessEqual(count, 1)
-        
+
     def testDeleteAvatar(self):
         self.testNormalImageUpload()
         avatar = Avatar.objects.filter(user=self.user)
@@ -99,7 +106,7 @@ class AvatarUploadTests(TestCase):
         self.failUnlessEqual(len(response.redirect_chain), 1)
         count = Avatar.objects.filter(user=self.user).count()
         self.failUnlessEqual(count, 0)
-        
+
     def testDeletePrimaryAvatarAndNewPrimary(self):
         self.testThereCanBeOnlyOnePrimaryAvatar()
         primary = get_primary_avatar(self.user)
@@ -116,7 +123,7 @@ class AvatarUploadTests(TestCase):
     def testTooManyAvatars(self):
         for i in range(0, AVATAR_MAX_AVATARS_PER_USER):
             self.testNormalImageUpload()
-        count_before = Avatar.objects.filter(user=self.user).count()       
+        count_before = Avatar.objects.filter(user=self.user).count()
         response = upload_helper(self, "test.png")
         count_after = Avatar.objects.filter(user=self.user).count()
         self.failUnlessEqual(response.status_code, 200)
@@ -129,5 +136,5 @@ class AvatarUploadTests(TestCase):
     # def testHashFileName
     # def testHashUserName
     # def testChangePrimaryAvatar
-    # def testDeleteThumbnailAndRecreation    
+    # def testDeleteThumbnailAndRecreation
     # def testAutomaticThumbnailCreation
diff --git a/docs/usage.txt b/docs/usage.txt
index 327e8ba..6c38a95 100644
--- a/docs/usage.txt
+++ b/docs/usage.txt
@@ -10,7 +10,7 @@ that are required.  A minimal integration can work like this:
 
 1.  List this application in the ``INSTALLED_APPS`` portion of your settings
     file.  Your settings file will look something like::
-   
+
         INSTALLED_APPS = (
             # ...
             'avatar',
@@ -18,7 +18,7 @@ that are required.  A minimal integration can work like this:
 
 2.  Add the pagination urls to the end of your root urlconf.  Your urlconf
     will look something like::
-    
+
         urlpatterns = patterns('',
             # ...
             (r'^admin/(.*)', admin.site.root),
@@ -27,20 +27,20 @@ that are required.  A minimal integration can work like this:
 
 3.  Somewhere in your template navigation scheme, link to the change avatar
     page::
-    
+
         <a href="{% url 'avatar_change' %}">Change your avatar</a>
 
 4.  Wherever you want to display an avatar for a user, first load the avatar
     template tags::
-    
+
         {% load avatar_tags %}
-    
+
     Then, use the ``avatar`` tag to display an avatar of a default size::
-    
+
         {% avatar user %}
-    
+
     Or specify a size (in pixels) explicitly::
-    
+
         {% avatar user 65 %}
 
 5.  Optionally customize ``avatar/change.html`` and
@@ -59,7 +59,7 @@ Changing an avatar
 The actual view function is located at ``avatar.views.change``, and this can
 be referenced by the url name ``avatar_change``.  It takes two keyword
 arguments: ``extra_context`` and ``next_override``.  If ``extra_context`` is
-provided, that context will be placed into the template's context.  
+provided, that context will be placed into the template's context.
 
 If ``next_override`` is provided, the user will be redirected to the specified
 URL after form submission.  Otherwise the user will be redirected to the URL
@@ -128,6 +128,12 @@ AVATAR_DEFAULT_URL
     The default URL to default to if ``AVATAR_GRAVATAR_BACKUP`` is set to False
     and there is no ``Avatar`` instance found in the system for the given user.
 
+AVATAR_ALLOWED_MIMETYPES
+    Limit allowed avatar image uploads by their actual content payload and what image codecs we wish to support.
+    This limits website user content site attack vectors against image codec buffer overflow and similar bugs.
+    `You must have python-imaging library installed <https://github.com/ahupp/python-magic>`_.
+    Suggested safe setting: ``("image/png", "image/gif", "image/jpeg")``.
+    When enabled you'll get the following error on the form upload *File content is invalid. Detected: image/tiff Allowed content types are: image/png, image/gif, image/jpg*.
 
 Management Commands
 -------------------