Unfortunately user can upload files by default.
Olate 3.4.2 check the extension of uploaded file and by default you can't
upload anything. Admin have to indicate which extensions are allowed for
uploading.
Here is code:
if ($site_config['enable_useruploads'] == 1)
{
// Upload file
if (isset($_FI...

[ more ]