We don't want files without extension or starting with a .

It is possible by the JavaScript side to set file name to .profile or no-extenstion. That is not cool.

This probably causes a notice through pathinfo() or services a hidden file.