M http.go → http.go

@@ -13,6 +13,7 @@ "html/template"
 	"io"
 	"io/ioutil"
 	"log"
+	"mime"
 	"net/http"
 	"os"
 	"path"
@@ -82,6 +83,11 @@ renderError(w, "403: Forbidden", 403)
 		return
 	}
 	fileName := filepath.Clean(r.URL.Path[len("/edit/"):])
+	isText := strings.HasPrefix(mime.TypeByExtension(path.Ext(fileName)), "text")
+	if !isText {
+		renderError(w, "Not a text file", 400) // correct status code?
+		return
+	}
 	filePath := path.Join(c.FilesDirectory, authUser, fileName)
 	if r.Method == "GET" {
 		err := checkIfValidFile(filePath, nil)