Replace the extension php5 in file_save_upload()

The currently used code is the following one.

  else {
    // No validator was provided, so add one using the default list.
    // Build a default non-munged safe list for file_munge_filename().
    $extensions = 'jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp';
    $validators['file_validate_extensions'] = array();
    $validators['file_validate_extensions'][0] = $extensions;
  }
  if (!variable_get('allow_insecure_uploads', 0)) {
    if (!empty($extensions)) {

      // Munge the filename to protect against possible malicious extension hiding
      // within an unknown file type (ie: filename.html.foo).
      $file->filename = file_munge_filename($file->filename, $extensions);
    }

The code does not even check for the following extensions: .php, .pl, .py, .cgi, .asp, .js. Either the code became too permissive, or those extensions are handled by a different function.

Actually, the code only allows the extensions passed in $extensions.
file_validate_extensions(), called from the code I shown in the previous comment, contains the following code.

function file_validate_extensions(stdClass $file, $extensions) {
  $errors = array();
  $regex = '/\\.(' . preg_replace('/ +/', '|', preg_quote($extensions)) . ')$/i';
  if (!preg_match($regex, $file->filename)) {
    $errors[] = t('Only files with the following extensions are allowed: %files-allowed.', array(
      '%files-allowed' => $extensions,
    ));
  }
  return $errors;
}

It seems this issue became outdated.