    public function is_allowed_file($fileName)
    {
        $allowedImages = $this->get_allowed_files_extensions_for_upload('images');
        $allowedVideos = $this->get_allowed_files_extensions_for_upload('videos');
        $allowedAudios = $this->get_allowed_files_extensions_for_upload('audios');
        $allowedFiles = $this->get_allowed_files_extensions_for_upload('files');
        $allowedDocuments = $this->get_allowed_files_extensions_for_upload('documents');
        $allowedArchives = $this->get_allowed_files_extensions_for_upload('archives');

        $allowed = array_merge_recursive($allowedImages,$allowedVideos,$allowedAudios,$allowedFiles,$allowedDocuments,$allowedArchives);

        $isExt = get_file_extension($fileName);
        $isExt = strtolower($isExt);

        if (in_array($isExt, $allowed)) {
            return true;
        }

        return false;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.