diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb
index 1e71187bedd..e3554723690 100644
--- a/app/controllers/uploads_controller.rb
+++ b/app/controllers/uploads_controller.rb
@@ -1,5 +1,8 @@
 class UploadsController < ApplicationController
+  before_filter :ensure_logged_in
+
   def create
+    requires_parameter(:topic_id)
     file = params[:file] || params[:files].first
     upload = Upload.create_for(current_user, file, params[:topic_id])
     render_serialized(upload, UploadSerializer, root: false)
diff --git a/spec/controllers/uploads_controller_spec.rb b/spec/controllers/uploads_controller_spec.rb
new file mode 100644
index 00000000000..6a1da3fc210
--- /dev/null
+++ b/spec/controllers/uploads_controller_spec.rb
@@ -0,0 +1,70 @@
+require 'spec_helper'
+
+describe UploadsController do
+
+  it 'requires you to be logged in' do
+    -> { xhr :post, :create }.should raise_error(Discourse::NotLoggedIn)
+  end
+
+  context 'logged in' do
+
+    before do
+      @user = log_in :user
+    end
+
+    context '.create' do
+
+      context 'missing params' do
+        it 'raises an error without the topic_id param' do
+          -> { xhr :post, :create }.should raise_error(Discourse::InvalidParameters)
+        end
+      end
+
+      context 'correct params' do
+
+        let(:logo) do
+          ActionDispatch::Http::UploadedFile.new({
+            filename: 'logo.png',
+            content_type: 'image/png',
+            tempfile: File.new("#{Rails.root}/spec/fixtures/images/logo.png")
+          })
+        end
+
+        let(:logo_dev) do
+          ActionDispatch::Http::UploadedFile.new({
+            filename: 'logo-dev.png',
+            content_type: 'image/png',
+            tempfile: File.new("#{Rails.root}/spec/fixtures/images/logo-dev.png")
+          })
+        end
+
+        let(:files) { [ logo_dev, logo ] }
+
+        context 'with a file' do
+          it 'is succesful' do
+            xhr :post, :create, topic_id: 1234, file: logo
+            response.should be_success
+          end
+        end
+
+        context 'with some files' do
+
+          it 'is succesful' do
+            xhr :post, :create, topic_id: 1234, files: files
+            response.should be_success
+          end
+
+          it 'takes the first file' do
+            xhr :post, :create, topic_id: 1234, files: files
+            response.body.should match /logo-dev.png/
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+
+end
diff --git a/spec/fixtures/images/logo-dev.png b/spec/fixtures/images/logo-dev.png
new file mode 100644
index 00000000000..1b309fc3755
Binary files /dev/null and b/spec/fixtures/images/logo-dev.png differ
diff --git a/spec/fixtures/images/logo.png b/spec/fixtures/images/logo.png
new file mode 100644
index 00000000000..c8d7600f7ab
Binary files /dev/null and b/spec/fixtures/images/logo.png differ