Do not allow HTML media files - risk of XSS attacks
Merge remote-tracking branch 'upstream/master'