File validation for "jpg" allows "file.jpg.bmp"

Caused by the file extension check which is done with an in_array($extension, explode('.', $filename)): Any files can be uploaded when the filename contains a defined extension between two dots. It doesn't necessarily need to occur at the end of the filename, which is where the bug lies (but then, cases like "tar.gz" should also be considered).

Which is bad - I think this can be regarded as critical bug.