[_def]

They checked mime type for upload validation. Obviously the server request handler was configured to pass files to php, that was the whole point of the story.