Removed check to allow php files through file upload if they are in the allowed list. PHP are never allowed.