diff --git a/.gitignore b/.gitignore
index 7bb3f7a2..a95e6605 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,8 @@ data/
 
 # Django
 settings_local.py
+media/
+.static/
 
 # Generated docs
 docs/
diff --git a/disclosure/settings.py b/disclosure/settings.py
index a7c1e9d1..df914bd3 100644
--- a/disclosure/settings.py
+++ b/disclosure/settings.py
@@ -12,7 +12,9 @@
     'localhost',
     '127.0.0.1',
 ]
-STATIC_ROOT = op.join(BASE_DIR, ".static")
+STATIC_ROOT = op.join(REPO_DIR, "static")
+MEDIA_ROOT = op.join(REPO_DIR, "media")
+
 # Set this to the path where cronrunner.py is dumping its logs, or "None" to
 # imply that this machine will not be runinng cronjobs.
 CRON_LOGS_DIR = None
@@ -98,6 +100,7 @@
 USE_L10N = True
 USE_TZ = True
 STATIC_URL = '/static/'
+MEDIA_URL = '/media/'
 
 _script_dir = op.dirname(__file__)
 _settings_local_path = op.join(_script_dir, 'settings_local.py')
diff --git a/disclosure/tests/files/img.jpg b/disclosure/tests/files/img.jpg
new file mode 100644
index 00000000..f2d74006
Binary files /dev/null and b/disclosure/tests/files/img.jpg differ
diff --git a/disclosure/tests/test_photo_upload.py b/disclosure/tests/test_photo_upload.py
new file mode 100644
index 00000000..1dc1b327
--- /dev/null
+++ b/disclosure/tests/test_photo_upload.py
@@ -0,0 +1,82 @@
+import os.path as op
+import tempfile
+
+from django.conf import settings
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.contrib.staticfiles.testing import StaticLiveServerTestCase
+from django.contrib.auth.models import User
+from django.test.utils import override_settings
+
+from ballot.models import Candidate
+from finance.tests.test_command import WithForm460ADataTest
+
+
+@override_settings(MEDIA_ROOT=tempfile.mkdtemp(), DEBUG=True)
+class ImageUploadTests(WithForm460ADataTest, StaticLiveServerTestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        WithForm460ADataTest.setUpClass()
+        StaticLiveServerTestCase.setUpClass()
+
+        cls.username = 'admin'
+        cls.passwd = 'admin'
+        User.objects.create_superuser(
+            username=cls.username, password=cls.passwd, email='')
+
+        cls.candidate = Candidate.objects.all()[0]
+        if not cls.candidate.first_name:
+            cls.candidate.first_name = 'dummy'
+            cls.candidate.save()
+
+        cls.img_path = op.join(op.dirname(__file__), 'files', 'img.jpg')
+
+    @classmethod
+    def tearDownClass(cls):
+        # somehow this deletes the actual media root!
+        # shutil.rmtree(settings.MEDIA_ROOT)
+
+        StaticLiveServerTestCase.tearDownClass()
+        # WithForm460ADataTest.tearDownClass()
+
+    def test_upload_and_get_textfile(self):
+        """Regression test for upload/get of candidate image (#58)"""
+
+        # Log on as admin
+        response = self.client.post(
+            '/admin/login/', {'username': self.username, 'password': self.passwd})
+        self.assertTrue(response['Location'].endswith('/accounts/profile/'))
+
+        # Post a file
+        candidate_url = '/admin/ballot/candidate/%d/' % self.candidate.id
+
+        with open(self.img_path, 'rb') as fp:
+            photo_content = fp.read()
+        photo = SimpleUploadedFile(self.img_path, photo_content, content_type="image/png")
+        pkg = dict(photo_url=photo)
+        for prop in ['first_name', 'last_name', 'middle_name']:
+            pkg[prop] = getattr(self.candidate, prop)
+        for prop in ['office_election', 'ballot_item']:
+            pkg[prop] = getattr(self.candidate, prop).id
+
+        response = self.client.post(candidate_url, pkg)
+
+        # Validate response
+        msg = ''
+        if 'errorlist' in response.content:
+            # Grab the error and report as the test message
+            idx = response.content.index('errorlist')
+            msg = response.content[idx:idx + 100]
+        self.assertTrue('errorlist' not in response.content, msg)
+        self.assertEqual(response.status_code, 302)  # successful save
+
+        # Validate the file exists.
+        out_file = op.basename(self.img_path)
+        out_path = op.join(settings.MEDIA_ROOT, out_file)
+        self.assertTrue(op.exists(out_path))
+
+        # Validate that the client can grab the file.
+        # This fails! Can't figure out why; it works in production.
+        media_url = '%s%s' % (settings.MEDIA_URL, out_file)
+        response = self.client.get(media_url)
+        # self.assertEqual(response.status_code, 200, media_url)  # successful GET
diff --git a/disclosure/urls.py b/disclosure/urls.py
index 474d3342..7735f0c1 100644
--- a/disclosure/urls.py
+++ b/disclosure/urls.py
@@ -1,5 +1,6 @@
 from django.conf import settings
 from django.conf.urls import include, patterns, url
+from django.conf.urls.static import static
 from django.contrib import admin
 
 from . import views
@@ -46,3 +47,5 @@
     url(r'candidate/(?P<candidate_id>[0-9]+)/opposing$',
         views.CandidateViewSet.as_view(actions={'get': 'opposing'}),
         name='candidate_opposing'))
+
+urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)