diff --git a/src/usr/local/www/widgets/widgets/picture.widget.php b/src/usr/local/www/widgets/widgets/picture.widget.php
index 981ec5dbd5..41a3702ec3 100644
--- a/src/usr/local/www/widgets/widgets/picture.widget.php
+++ b/src/usr/local/www/widgets/widgets/picture.widget.php
@@ -25,6 +25,7 @@ require_once("guiconfig.inc");
 require_once("pfsense-utils.inc");
 require_once("functions.inc");
 
+
 if ($_GET['getpic']=="true") {
 	$pic_type_s = explode(".", $user_settings['widgets'][$_GET['widgetkey']]['picturewidget_filename']);
 	$pic_type = $pic_type_s[1];
@@ -40,7 +41,6 @@ if ($_GET['getpic']=="true") {
 
 if ($_POST['widgetkey']) {
 	set_customwidgettitle($user_settings);
-
 	if (is_uploaded_file($_FILES['pictfile']['tmp_name'])) {
 		/* read the file contents */
 		$fd_pic = fopen($_FILES['pictfile']['tmp_name'], "rb");
@@ -53,6 +53,14 @@ if ($_POST['widgetkey']) {
 			log_error("Warning, could not read file " . $_FILES['pictfile']['tmp_name']);
 			die("Could not read temporary file");
 		} else {
+			// Make sure they upload an image and not some other file
+			$img_info =getimagesize($_FILES['pictfile']['tmp_name']);
+			if($img_info === FALSE){
+				die("Unable to determine image type of uploaded file");
+			}
+			if(($img_info[2] !== IMAGETYPE_GIF) && ($img_info[2] !== IMAGETYPE_JPEG) && ($img_info[2] !== IMAGETYPE_PNG)){
+				die("Not a gif/jpg/png");
+			}
 			$picname = basename($_FILES['uploadedfile']['name']);
 			$user_settings['widgets'][$_POST['widgetkey']]['picturewidget'] = base64_encode($data);
 			$user_settings['widgets'][$_POST['widgetkey']]['picturewidget_filename'] = $_FILES['pictfile']['name'];
@@ -66,14 +74,14 @@ if ($_POST['widgetkey']) {
 
 ?>
 <?php
-if($user_settings['widgets'][$widgetkey] != null){?>
+if($user_settings['widgets'][$widgetkey]["picturewidget"] != null){?>
 <a href="/widgets/widgets/picture.widget.php?getpic=true&widgetkey=<?=htmlspecialchars($widgetkey)?>" target="_blank">
 	<img style="width:100%; height:100%" src="/widgets/widgets/picture.widget.php?getpic=true&widgetkey=<?=htmlspecialchars($widgetkey)?>" alt="picture" />
 </a>
 <?php } ?>
 <!-- close the body we're wrapped in and add a configuration-panel -->
 </div><div id="<?=$widget_panel_footer_id?>"
-	<?php echo "class= " . "'" . "panel-footer". ($user_settings['widgets'][$widgetkey] != null ? " collapse": ""). "'";  ?>>
+	<?php echo "class= " . "'" . "panel-footer". ($user_settings['widgets'][$widgetkey]["picturewidget"] != null ? " collapse": ""). "'";  ?>>
 
 <form action="/widgets/widgets/picture.widget.php" method="post" enctype="multipart/form-data" class="form-horizontal">
 	<input type="hidden" name="widgetkey" value="<?=htmlspecialchars($widgetkey); ?>">
@@ -81,7 +89,7 @@ if($user_settings['widgets'][$widgetkey] != null){?>
 	<div class="form-group">
 		<label for="pictfile" class="col-sm-4 control-label"><?=gettext('New picture:')?> </label>
 		<div class="col-sm-6">
-			<input id="pictfile" name="pictfile" type="file" class="form-control" />
+			<input id="pictfile" name="pictfile" type="file" class="form-control" accept="image/*"/>
 		</div>
 	</div>
 	<div class="form-group">