func HandleUploadFile(r *http.Request, filetype string) (string, error) {
	file, handler, err := r.FormFile("file")
	if err != nil {
		return "", err
	}
	defer file.Close()
	filename := strings.ToLower(handler.Filename)
	fileAllowed := false
	filetypeArr := strings.Split(filetype, ",")
	for _, extension := range filetypeArr {
		if extension == "*" || strings.HasSuffix(filename, extension) {
			fileAllowed = true
			break
		}
	}
	if !fileAllowed {
		return "", errors.New("File format not allowed.")
	}
	tempFolder := util.GetConfig("general", "upload_tempfolder")
	tempFolderAbs := util.VarFolder() + "/" + tempFolder
	reg := regexp.MustCompile("[^-A-Za-z0-9_.]")
	filename = reg.ReplaceAllString(filename, "_")  
	tempFile, err := ioutil.TempFile(tempFolderAbs, "upload-*-"+filename)
	defer tempFile.Close()
	if err != nil {
		return "", err
	}
	fileContent, err := ioutil.ReadAll(file)
	if err != nil {
		return "", err
	}
	tempFile.Chmod(0664)
	tempFile.Write(fileContent)
	pathArr := strings.Split(tempFile.Name(), "/")
	tempFilename := pathArr[len(pathArr)-1]
	return tempFolder + "/" + tempFilename, nil
}
Handler uploaded file, return filename & error
package rest
import (
	"errors"
	"io/ioutil"
	"log"
	"net/http"
	"os"
	"os/exec"
	"regexp"
	"strconv"
	"strings"
	"github.com/digimakergo/digimaker/core/permission"
	"github.com/digimakergo/digimaker/core/query"
	"github.com/digimakergo/digimaker/core/util"
	"github.com/gorilla/mux"
	pongo2 "gopkg.in/flosch/pongo2.v2"
)
func UploadFile(w http.ResponseWriter, r *http.Request) {
	section := util.GetConfigSectionI("rest")
	needAuth := section["upload_file_auth"].(bool)
	if needAuth {
		userId := CheckUserID(r.Context(), w)
		if userId == 0 || !permission.HasAccessTo(r.Context(), userId, "util/upload") {
			HandleError(errors.New("Need authorization"), w)
			return
		}
	}
	filename, err := HandleUploadFile(r, "*")
	result := ""
	if err != nil {
		HandleError(err, w)
		return
	}
	result = filename
	WriteResponse(result, w)
}
func UploadImage(w http.ResponseWriter, r *http.Request) {
	userId := CheckUserID(r.Context(), w)
	if userId == 0 {
		return
	}
	filename, err := HandleUploadFile(r, ".gif,.jpg,.jpeg,.png")
	result := ""
	if err != nil {
		HandleError(err, w)
		return
	}
	result = filename
	WriteResponse(result, w)
}