Small improvements in uploads security

misago/apps/usercp/avatar/views.py

@@ -1,5 +1,6 @@
 from path import path
 from PIL import Image
+from zipfile import is_zipfile
 from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.core.urlresolvers import reverse
@@ -122,6 +123,9 @@ def upload(request):
                     destination.write(chunk)
             request.user.save()
             try:
+                if is_zipfile(image_path):
+                    # Composite file upload
+                    raise ValidationError()                    
                 image = Image.open(image_path)
                 if not image.format in ['GIF', 'PNG', 'JPEG']:
                     raise ValidationError()

misago/urls.py

@@ -50,7 +50,7 @@ handler403 = 'misago.apps.errors.error403'
 handler404 = 'misago.apps.errors.error404'
 
 # Make sure people are not keeping uploads and app under same domain
-from django.core.exceptions import ImproperlyConfigured
+import warnings
 from urlparse import urlparse
 if not settings.DEBUG and not urlparse(settings.MEDIA_URL).netloc:
-    raise ImproperlyConfigured('Sharing same domain name between application and user uploaded media is a security risk. Create a subdomain pointing to your media directory (eg. "uploads.myforum.com") and change your MEDIA_URL.')
+    warnings.warn('Sharing same domain name between application and user uploaded media is a security risk. Create a subdomain pointing to your media directory (eg. "uploads.myforum.com") and change your MEDIA_URL.', RuntimeWarning)