diff --git a/include/api.tickets.php b/include/api.tickets.php
index 7346f2b2943bbc5c0451d62fcc7952677034b6d5..502541fe679795ef7d1309be5873b8e97a57010a 100644
--- a/include/api.tickets.php
+++ b/include/api.tickets.php
@@ -24,6 +24,34 @@ class TicketApiController extends ApiController {
         return $supported;
     }
 
+    /* 
+     Validate data - overwrites parent's validator for additional validations.
+    */
+    function validate(&$data, $format) {
+        global $ost;
+
+        //Call parent to Validate the structure
+        if(!parent::validate($data, $format))
+            $this->exerr(400, 'Unexpected or invalid data received');
+
+        //Validate attachments: Do error checking... soft fail - set the error and pass on the request.
+        if($data['attachments'] && is_array($data['attachments'])) {
+            foreach($data['attachments'] as &$attachment) {
+                if(!$ost->isFileTypeAllowed($attachment))
+                    $data['error'] = 'Invalid file type (ext) for '.Format::htmlchars($attachment['name']);
+                elseif ($attachment['encoding'] && !strcasecmp($attachment['encoding'], 'base64')) {
+                    if(!($attachment['data'] = base64_decode($attachment['data'], true)))
+                        $attachment['error'] = sprintf('%s: Poorly encoded base64 data', Format::htmlchars($attachment['name']));
+                }
+            }
+        }
+        unset($attachment);
+
+        return true;
+
+    }
+
+
     function create($format) {
 
         if(!($key=$this->requireApiKey()) || !$key->canCreateTickets())
@@ -70,11 +98,6 @@ class TicketApiController extends ApiController {
             return $this->exerr(500, "Unable to create new ticket: unknown error");
         }
 
-        
-        # Save attachment(s)
-        if($data['attachments'])
-            $ticket->importAttachments($data['attachments'], $ticket->getLastMsgId(), 'M');
-
         return $ticket;
     }
 
diff --git a/include/class.api.php b/include/class.api.php
index dd0706ceaa374b5ee35c065ce9066590c53e4e05..6403222cc783428b144c7c751f0b11102b5aaf0b 100644
--- a/include/class.api.php
+++ b/include/class.api.php
@@ -192,6 +192,7 @@ class ApiController {
      * work will be done for XML requests
      */
     function getRequest($format) {
+        global $ost;
         
         $input = (substr(php_sapi_name(), 0, 3) == 'cli')?'php://stdin':'php://input';
 
@@ -219,7 +220,8 @@ class ApiController {
         if (!($data = $parser->parse($stream)))
             $this->exerr(400, $parser->lastError());
        
-        $this->validate($data, $this->getRequestStructure($format));
+        //Validate structure of the request.
+        $this->validate($data, $format);
 
         return $data;
     }
@@ -239,19 +241,33 @@ class ApiController {
      * expected. It is assumed that the functions actually implementing the
      * API will further validate the contents of the request
      */
-    function validate($data, $structure, $prefix="") {
+    function validateRequestStructure($data, $structure, $prefix="") {
+       
         foreach ($data as $key=>$info) {
             if (is_array($structure) and is_array($info)) {
                 $search = (isset($structure[$key]) && !is_numeric($key)) ? $key : "*"; 
                 if (isset($structure[$search])) {
-                    $this->validate($info, $structure[$search], "$prefix$key/");
+                    $this->validateRequestStructure($info, $structure[$search], "$prefix$key/");
                     continue;
                 }
             } elseif (in_array($key, $structure)) {
                 continue;
             }
-            $this->exerr(400, "$prefix$key: Unexpected data received");
+            return $this->exerr(400, "$prefix$key: Unexpected data received");
         }
+
+        return true;
+    }
+
+    /**
+     * Validate request.
+     *
+     */
+    function validate(&$data, $format) {
+        return $this->validateRequestStructure(
+                $data, 
+                $this->getRequestStructure($format)
+                );
     }
 
     /**