Improvements to image file validation

wagtail/wagtailimages/utils.py

@@ -20,9 +20,16 @@ def validate_image_format(f):
         # Open image file
         file_position = f.tell()
         f.seek(0)
-        image = Image.open(f)
+
+        try:
+            image = Image.open(f)
+        except IOError:
+            # Uploaded file is not even an image file (or corrupted)
+            raise ValidationError(_("Not a valid image. Please use a gif, jpeg or png file with the correct file extension."))
+
         f.seek(file_position)
 
         # Check that the internal format matches the extension
+        # It is possible to upload PSD files if their extension is set to jpg, png or gif. This should catch them out
         if image.format.upper() != extension.upper():
             raise ValidationError(_("Not a valid %s image. Please use a gif, jpeg or png file with the correct file extension.") % (extension.upper()))

wagtail/wagtailimages/views/multiple.py

@@ -12,6 +12,7 @@ from django.utils.translation import ugettext as _
 
 from wagtail.wagtailimages.models import get_image_model
 from wagtail.wagtailimages.forms import get_image_form_for_multi
+from wagtail.wagtailimages.utils import validate_image_format
 
 
 def json_response(document):
@@ -31,28 +32,32 @@ def add(request):
         if not request.FILES:
             return HttpResponseBadRequest("Must upload a file")
 
+        # Check that the uploaded file is valid
         try:
-            image = Image(uploaded_by_user=request.user, title=request.FILES['files[]'].name, file=request.FILES['files[]'])
-            image.full_clean()
-            image.save()
-
-            # Success! Send back an edit form for this image to the user
-            form = ImageForm(instance=image, prefix='image-%d' % image.id)
-
-            return json_response({
-                'success': True,
-                'image_id': int(image.id),
-                'form': render_to_string('wagtailimages/multiple/edit_form.html', {
-                    'image': image,
-                    'form': form,
-                }, context_instance=RequestContext(request)),
-            })
+            validate_image_format(request.FILES['files[]'])
         except ValidationError as e:
             return json_response({
                 'success': False,
                 'error_message': '\n'.join(e.messages),
             })
 
+        # Save it
+        image = Image(uploaded_by_user=request.user, title=request.FILES['files[]'].name, file=request.FILES['files[]'])
+        image.save()
+
+        # Success! Send back an edit form for this image to the user
+        form = ImageForm(instance=image, prefix='image-%d' % image.id)
+
+        return json_response({
+            'success': True,
+            'image_id': int(image.id),
+            'form': render_to_string('wagtailimages/multiple/edit_form.html', {
+                'image': image,
+                'form': form,
+            }, context_instance=RequestContext(request)),
+        })
+
+
     return render(request, 'wagtailimages/multiple/add.html', {})