Not able to restrict other files from uploading in ElFinder

Question

I am using this configuration for my Elfinder to use with CKEditor.

$opts = array(
    // 'debug' => true,
    'roots' => array(
        array(
            'driver'        => 'LocalFileSystem',   // driver for accessing file system (REQUIRED)
            'path'          => '../../uploads/',         // path to files (REQUIRED)
            'URL'           => dirname($_SERVER['PHP_SELF']) . '/../../uploads/', // URL to files (REQUIRED)
            'accessControl' => 'access'  ,           // disable and hide dot starting files (OPTIONAL)
            'uploadAllow' => array('image/jpg', 'image/png'),
            'alias'      => 'Home',
            'mimeDetect' => 'internal',
            'imgLib'     => 'gd',
        ),


    ),


);

However, I am able to upload all the files even PHP files!! I only want images to be uploaded. I am not able to restrict the uploading. Where am I going wrong?

Answer 1

Add:

'uploadOrder'=> array( 'allow', 'deny' )

Without this the default policy is allow if none of them matches.

According to: https://github.com/Studio-42/elFinder/wiki/Connector-configuration-options#wiki-uploadOrder