List of allowed extensions should be configurable. Also Yii supports proper mimetype validation for uploaded files.