diff --git a/htdocs/lib/settings/ImageUpload.js b/htdocs/lib/settings/ImageUpload.js
index e95eaab..b81d9e8 100644
--- a/htdocs/lib/settings/ImageUpload.js
+++ b/htdocs/lib/settings/ImageUpload.js
@@ -12,6 +12,7 @@ $.fn.imageUpload = function() {
 
         input.onchange = function(e) {
             var reader = new FileReader()
+            // TODO: implement file size check
             reader.readAsArrayBuffer(e.target.files[0]);
             reader.onload = function(e) {
                 $.ajax({
diff --git a/owrx/controllers/imageupload.py b/owrx/controllers/imageupload.py
index 000b4d5..9275be3 100644
--- a/owrx/controllers/imageupload.py
+++ b/owrx/controllers/imageupload.py
@@ -4,6 +4,7 @@ import uuid
 import json
 
 
+# TODO: implement authorization
 class ImageUploadController(AssetsController):
     def __init__(self, handler, request, options):
         super().__init__(handler, request, options)
@@ -26,6 +27,7 @@ class ImageUploadController(AssetsController):
 
     def processImage(self):
         self.uuid = uuid.uuid4().hex
+        # TODO: limit file size
         contents = self.get_body()
         with open(self.getFilePath(), 'wb') as f:
             f.write(contents)