title: Validating Uploaded Files in Django
body: <p>A Django app that I am working has an <code>Event</code> model. An <code>Event</code> may have associated photos, static html files and pdf files.</p>
  
  <p>I would like to allow trusted users to upload these files, but I am wary about security, especially having read the following <a href="http://docs.djangoproject.com/en/dev/ref/models/fields/#filefield" rel="noreferrer">in the Django docs</a> (link).</p>
  
  <blockquote>
    <p>Note that whenever you deal with
    uploaded files, you should pay close
    attention to where you're uploading
    them and what type of files they are,
    to avoid security holes. Validate all
    uploaded files so that you're sure the
    files are what you think they are. For
    example, if you blindly let somebody
    upload files, without validation, to a
    directory that's within your Web
    server's document root, then somebody
    could upload a CGI or PHP script and
    execute that script by visiting its
    URL on your site. Don't allow that.</p>
  </blockquote>
  
  <p>How can I validate the different types of files? I would be interested to hear anyone's experience of dealing with this kind of thing, or links for further reading. I have a gut feeling that html files may be too risky, in which case I'll restrict upload permissions to the administrator.</p>