File extension check ignores trailing characters
util_check_valid_extension function will ignore any characters after a matched file extension, so that
xslfoooo will all return
XSLT_CONTENT, even though the last one really should not.
Additionally there is a check for
htm and after that another one for
html, but the first check will always match even in the case of html, so that code is actually useless and never execute.