File upload command execution

[e0mlja]

In the background, you can upload the PHP file by changing the image suffix to PHP, resulting in command execution.

url：http://192.168.18.143/admin/index.php?r=admin-user%2Fupdate-self

[liufee]

thanks for the feedback.
it has been fix, see commit.
because yii2 FileValidator need custom assign value to attribute