Commit 5c908cf

@@ -7,12 +7,16 @@ class TrainingSessionsController < ApplicationController
   end
 
   def upload
-    UploadStrongliftsBackupJob.perform_later(
-      current_user,
-      storage.store(params[:backup]),
-      Program.stronglifts
-    )
-    redirect_to dashboard_path, notice: t(".success")
+    if legitimate_file?(params[:backup])
+      UploadStrongliftsBackupJob.perform_later(
+        current_user,
+        storage.store(params[:backup]),
+        Program.stronglifts
+      )
+      redirect_to dashboard_path, notice: t(".success")
+    else
+      redirect_to dashboard_path, alert: t(".failure")
+    end
   end
 
   private
@@ -20,4 +24,8 @@ class TrainingSessionsController < ApplicationController
   def storage
     @storage ||= TemporaryStorage.new
   end
+
+  def legitimate_file?(file)
+    file.original_filename.end_with?(".stronglifts")
+  end
 end

@@ -53,5 +53,6 @@ en:
       upload_backup_button: "Upload"
     upload:
       success: 'Our minions have been summoned to unpack your backup.'
+      failure: "We don't know how to unpack this type of file."
     training_session:
       body_weight: Body Weight

@@ -41,5 +41,16 @@ describe TrainingSessionsController do
       translation = I18n.translate("training_sessions.upload.success")
       expect(flash[:notice]).to eql(translation)
     end
+
+    context "when the file is not a backup file" do
+      let(:unknown_file) { fixture_file_upload("unknown.file") }
+
+      it "displays an error" do
+        post :upload, backup: unknown_file
+        translation = I18n.translate("training_sessions.upload.failure")
+        expect(flash[:alert]).to eql(translation)
+        expect(response).to redirect_to(dashboard_path)
+      end
+    end
   end
 end