doph/minimal-django-file-upload-example — pull request #2 by Voulnet (2013-01-29 20:35:27+00:00)
Title: Update src/myproject/myapp/views.py

I added functionality to check if the file extension is of an allowed type using a whitelist approach. A whitelist approach means "allow known safe" which is better than a blacklist approach (reject known bad) because you can't know all bad file names.

Of course this modification doesn't take into account the mimetype, just the file extension, so if an attacker uploads a .exe (or .php or whatever) dangerous file as file.doc and you execute it, it will execute as it originally was (could be a virus or backdoor), so you have to open it only with the designated application (MS Word, Adobe Reader..etc) according to its extension.