Limit the types of files that may be attached to requests.

application/modules/courses/controllers/EditController.php

@@ -121,6 +121,10 @@ class Courses_EditController extends App_Controller_Action
         	}
 	        if ($_FILES['request']['error'][$fileType] === 0) {
 	            $title = $_FILES['request']['name'][$fileType];
+	            $fileExtension = array_pop(explode('.', $title));
+	            if (!in_array($fileExtension, array('rtf', 'pdf', 'odt', 'doc'))) {
+	            	continue;
+	            }
 	            $mimeType = $_FILES['request']['type'][$fileType];
 	            $content = file_get_contents($_FILES['request']['tmp_name'][$fileType]);
 	            $request->setFile($fileType, $title, $mimeType, $content);

application/modules/courses/views/scripts/edit/index.phtml

@@ -820,7 +820,6 @@ if (in_array($this->request->getType(), array('NewCourseWithACE', 'AddACEToCours
 <div class="main_section">
 <h2>Supportive Material</h2>
 
-
     <?php if (!in_array($this->request->getType(), array('AddACEToCourse', 'RemoveACEFromCourse'))) { ?>
     <fieldset>
         <label>
@@ -832,7 +831,6 @@ if (in_array($this->request->getType(), array('NewCourseWithACE', 'AddACEToCours
     <input type="hidden" name="request[justification]" value="See ACE Certification Details" />
     <?php } ?>
 
-
     <fieldset>
         <label>
             <?php if (in_array($this->request->getType(), array('NewCourse', 'NewCourseWithIS', 'NewCourseWithACE', 'AddACEToCourse', 'AddACEAndChangeCourse'))) { ?>
@@ -971,7 +969,15 @@ if (in_array($this->request->getType(), array('NewCourseWithACE', 'AddACEToCours
         <?php } ?>
     </fieldset>
 
-
+    <div id="allowedFileTypes">
+        Allowed file types for attachments are:
+        <ul>
+            <li><a href="http://en.wikipedia.org/wiki/Rich_text_format" target="_new">Rich Text Format (.rtf)</a></li>
+            <li><a href="http://en.wikipedia.org/wiki/Portable_document_format" target="_new">Portable Document Format (.pdf)</a></li>
+            <li><a href="http://en.wikipedia.org/wiki/Open_document_format" target="_new">OpenDocument Text (.odt)</a><li>
+            <li><a href="http://en.wikipedia.org/wiki/DOC_(computing)" target="_new">MS Word Documents (.doc)</a></li>
+        </ul>
+    </div>
 
 </div>