FIX: user shouldn't be able to change the image file