MyBB Community Forums

to check a file extension

$t = $_GET['name'];
$y = explode(".",$t);
if(count($y) > 2)
	{
		die()
	}
else
	{
		//do my thing
	}

the get used in the example above is for test on my localhost
the actual place this code is used has $t being filled via POST through $mybb->input and then "basename".

can this be beat

example
name.txt --- ok
name.exe.txt ---nope

if its not any suggestions --- get_extension in mybb functions.php is very complex

There are legit filenames with more then one dot in a given extension so your solution isn't feasible and could be riddled with bugs in production. You should look more into the logic of the MyBB get_extension function. It's not that complex compared to lets say, the sensors in a door on the Metro/Bart.

.htaccess

oops.

I think you shouldn't just check just extensions on file name, anyone can re-name an exploit to what ever that looks safe.