There's something in ​the docs that doesn't make much sense for me:

"No password will be assigned to this account, and you will not be able to log in as this user. To switch to this account, enter either:"

and then sudoes to mediagoblin user. Also, it says:

"Unless otherwise noted, the remainder of this document assumes that all operations are performed using this unpriviledged account."

In my opinion, user mediagoblin should get shell permissions and when finished remove them. Otherwise, do everything as another user and at the end chown it all, but it may break something.

 URL: http://dev.labath.info/u/david/m/54/comment/add/
Module paste.exceptions.errormiddleware:144 in __call__
>>  app_iter = self.application(environ, sr_checker)
Module paste.urlmap:203 in __call__
>>  return app(environ, start_response)
Module mediagoblin.app:259 in __call__
>>  return self.call_backend(environ, start_response)
Module mediagoblin.app:236 in call_backend
>>  response = controller(request)
Module mediagoblin.decorators:228 in wrapper
>>  return controller(request, media=media, *args, **kwargs)
Module mediagoblin.decorators:52 in new_controller_func
>>  return controller(request, *args, **kwargs)
Module mediagoblin.user_pages.views:171 in media_post_comment
>>  print request.form['comment_content']
Module paste.script.serve:530 in write
>>  fileobj.write(text)
UnicodeEncodeError: 'ascii' codec can't encode characters in position 4-7: ordinal not in range(128)

CONTENT_LENGTH 	'76'
CONTENT_TYPE 	'application/x-www-form-urlencoded'
CSRF_TOKEN 	u'12392610114171091612'
DOCUMENT_ROOT 	'/etc/nginx/html'
DOCUMENT_URI 	'/u/david/m/54/comment/add/'
GATEWAY_INTERFACE 	'CGI/1.1'
HTTP_ACCEPT 	'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
HTTP_ACCEPT_ENCODING 	'gzip, deflate'
HTTP_ACCEPT_LANGUAGE 	'en-US,en;q=0.5'
HTTP_CONNECTION 	'keep-alive'
HTTP_CONTENT_LENGTH 	'76'
HTTP_CONTENT_TYPE 	'application/x-www-form-urlencoded'
HTTP_COOKIE 	'mediagoblin_csrftoken=12392610114171091612; MGSession=eyJ1c2VyX2lkIjoiMSJ9.BRNMJg.bVqjn9L-hBu3d10VrncRc7QqLVA'
HTTP_HOST 	'dev.labath.info'
HTTP_REFERER 	'http://dev.labath.info/u/david/m/kalvaria-bs/'
HTTP_USER_AGENT 	'Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0'
PATH_INFO 	'/u/david/m/54/comment/add/'
REDIRECT_STATUS 	'200'
REMOTE_ADDR 	'216.221.67.237'
REMOTE_PORT 	'56579'
REQUEST_METHOD 	'POST'
REQUEST_URI 	'/u/david/m/54/comment/add/'
SCRIPT_FILENAME 	'/etc/nginx/html/u/david/m/54/comment/add/'
SERVER_ADDR 	'72.2.115.57'
SERVER_NAME 	'mediagoblin.example.org'
SERVER_PORT 	'80'
SERVER_PROTOCOL 	'HTTP/1.1'
SERVER_SOFTWARE 	'nginx/1.1.19'

WSGI Variables
application 	{(None, '/theme_static'): <StaticURLParser '/data/goblin/mediagoblin/user_dev/theme_static'>, (None, '/plugin_static'): <StaticURLParser '/data/goblin/mediagoblin/user_dev/plugin_static'>, (None, '/mgoblin_media'): <StaticURLParser '/data/goblin/mediagoblin/user_dev/media/public'>, (None, ''): <mediagoblin.app.MediaGoblinApp object at 0x27dc690>, (None, '/mgoblin_static'): <StaticURLParser '/data/goblin/mediagoblin/mediagoblin/static'>}
paste.throw_errors 	True
werkzeug.request 	<Request 'http://dev.labath.info/u/david/m/54/comment/add/' [POST]>
wsgi process 	'Multiprocess'


URL: http://dev.labath.info/u/david/m/54/comment/add/
File '/data/goblin/mediagoblin/local/lib/python2.7/site-packages/Paste-1.7.5.1-py2.7.egg/paste/exceptions/errormiddleware.py', line 144 in __call__
  app_iter = self.application(environ, sr_checker)
File '/data/goblin/mediagoblin/local/lib/python2.7/site-packages/Paste-1.7.5.1-py2.7.egg/paste/urlmap.py', line 203 in __call__
  return app(environ, start_response)
File '/data/goblin/mediagoblin/mediagoblin/app.py', line 259 in __call__
  return self.call_backend(environ, start_response)
File '/data/goblin/mediagoblin/mediagoblin/app.py', line 236 in call_backend
  response = controller(request)
File '/data/goblin/mediagoblin/mediagoblin/decorators.py', line 228 in wrapper
  return controller(request, media=media, *args, **kwargs)
File '/data/goblin/mediagoblin/mediagoblin/decorators.py', line 52 in new_controller_func
  return controller(request, *args, **kwargs)
File '/data/goblin/mediagoblin/mediagoblin/user_pages/views.py', line 171 in media_post_comment
  print request.form['comment_content']
File '/data/goblin/mediagoblin/local/lib/python2.7/site-packages/PasteScript-1.7.5-py2.7.egg/paste/script/serve.py', line 530 in write
  fileobj.write(text)
UnicodeEncodeError: 'ascii' codec can't encode characters in position 4-7: ordinal not in range(128)

VideoJS has XSS vulnerability

​http://mediagoblin.org/js/extlib/video-js/video-js.swf?readyFunction=alert%28%22a%22%29