Tested successfull with this script.

<?php
$intendedName = 'download.xml';
$explodedName = explode('.', $intendedName);
array_reverse($explodedName);
// $explodedName = array_reverse($explodedName);
array_pop($explodedName);
array_map('strtolower', $explodedName);

print_r($explodedName);

This return: Array ( [0] => download )

If we change the script to:

<?php
$intendedName = 'download.xml';
$explodedName = explode('.', $intendedName);
// array_reverse($explodedName);
$explodedName = array_reverse($explodedName);
array_pop($explodedName);
array_map('strtolower', $explodedName);

echo $explodedName;
print_r($explodedName);

It returns Array ( [0] => xml ).

Thanks.

Test : Success.

The original code is clearly wrong and making file extension check doesn't work properly (instead of removing file name from array, it actually removes the file extension, so file extension is not being checked/validated with $options['forbidden_extensions']). This PR just correct it.

Setting RTC. Thanks

Thank you @ryandemmer! It's important enough to be merged in the RC version, merging by code review.

We have now a regression on installing Kunena 3rt party templates:

Missing file to extract:

How to reproduce:

• install kunena
• download crypsisb3 www.kunena.org/download
• go to backend - kunena - template manager - new template
• select template and click on upload file and install

Extra info
our code: https://github.com/Kunena/Kunena-Forum/blob/develop/components/com_kunena/admin/controllers/templates.php#L98

@810 Reason is likely that you want to upload a file with a forbidden extension (eg ".php") then. That check was supposed to work since 3.4.0, but was broken.
If you use JFile::upload, you have to set the $allow_unsafe argument to true or explicitely pass $safeFileOptions with the correct options.

Hmm

I have same issue with my extension. I think you will need to modify code in the line 103

file = $this->app->input->files->get('install_package');

To

file = $this->app->input->files->get('install_package', null, 'raw');

The reason is because this block of code https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/input/files.php#L81-L89

As @Bakual said, this was a bug since 3.4.0 and was fixed finally in the version 3.4.4. Please use the raw parameter to suppress the safe file check.

I just wanted to point out the needed changes. There are two changes needed:

1. Use raw filter as I mentioned above.

2. If we use JFile::upload, we will have to set the $allow_unsafe argument to true or explicitely pass $safeFileOptions with the correct options as @Bakual mentioned.

@joomdonation Correct! Thank you for pointing it out.

ok, thnx we had that before, only without the allow_unsafe. We changed that. Now its working again.