Validating extensions in file uploads I am trying to create a file validator for .csv uploads.  This is my code that works at allowing csv uploads (which are disallowed by default):

$validators['file_validate_extensions'] = array('csv');
$file = file_save_upload('csv', $validators);


However, when I try to upload another file (in this case fizzbuzz.py) I get this error:

For security reasons, your upload has been renamed to fizzbuzz.py.txt.


How can I change this to being and out right error when a non csv file is uploaded?

EDIT: Did some more testing.  This only occurs for my .py file.  Files with a .png extension get rejected and are not uploaded.

EDITx2: Okay, so it also rejects .bat, .gnumeric, and .txt file extensions.  It looks like Drupal does not validate two letter file extensions in the same way it validates three(+) letter file extensions.
If you take a look at the file_save_upload() call, you'll see what's happening with the py files.  It seems to be a It will occur with php|pl|py|cgi|asp|js files.  

FROM: file_save_upload() http://api.drupal.org/api/drupal/includes!file.inc/function/file_save_upload/7

// Rename potentially executable files, to help prevent exploits (i.e. will
// rename filename.php.foo and filename.php to filename.php.foo.txt and
// filename.php.txt, respectively). Don't rename if 'allow_insecure_uploads'
// evaluates to TRUE.
if (!variable_get('allow_insecure_uploads', 0) &amp;&amp; preg_match('/\.(php|pl|py|cgi|asp|js) (\.|$)/i', $file-&gt;filename) &amp;&amp; (substr($file-&gt;filename, -4) != '.txt')) {
$file-&gt;filemime = 'text/plain';
$file-&gt;uri .= '.txt';
$file-&gt;filename .= '.txt';
// The .txt extension may not be in the allowed list of extensions. We have
// to add it here or else the file upload will fail.
if (!empty($extensions)) {
  $validators['file_validate_extensions'][0] .= ' txt';
  drupal_set_message(t('For security reasons, your upload has been renamed to %filename.', array('%filename' =&gt; $file-&gt;filename)));
}


}

If you wish to allow these uploads (without converting their extensions), you would set all_insecure_uploads to 1 (TRUE), but I doubt you do :)  

KMT