JG

 

AjaxUploader do not provide content-type for security version.

 

The content-type is send by client side and that is not trust-able.

 

Developer should check the extension and data to prevent the code be executed at server side.

 

Regards,
Terry