Add 'php' to list of disallowed file extensions