they have an extension called "pure php upload". There you can just type in the Extension you want to allow (not those you want to prevent, though). I found "pure php upload" more useful under certain circumstances than DFP from webassist. For example it adds undescores in filenames if people use this in filenames. Some Linux servers have problems with it.