`allowed_file` uploading bypass by simply changing file extension

[nevercodecorrect]

Hi,
When I try the product, I find that it is easy to bypass the file type restriction on the uploading functionality. The issue is CWE-646: Reliance on File Name or Extension of Externally-Supplied File

You could rename any file with the extension types presented in here to bypass the limitation. Only checking extension suffix in the filename is not enough, using magic number to check would be a better approach.

Thanks for your time reading.

[Timothyxxx]

Thanks for pointing that out, we will try to fix this part in the future.

[BlankCheng]

Thanks for your advice. This is indeed vulnerable. Would you like to open a PR to improve it? We'll be glad to have more contributors!