[root@localhost include]# grep -R upload_badext ../*
../config.php:  'upload_badext' =>
../include/utils.php:   global $upload_badext;
../include/utils.php:   'upload_badext' => empty($upload_badext) ? array (
../include/utils.php:      'asp', 'cfm', 'js', 'vbs', 'html', 'htm' ) : $upload_badext,
../include/utils.php:        'upload_badext' => array (
../include/upload_file.php:        foreach($sugar_config['upload_badext'] as $badExt) {
../install/localization.php:if(empty($sugar_config['upload_badext'])) {
../install/localization.php:    $sugar_config['upload_badext'] = array('php', 'php3', 'php4', 'php5', 'pl', 'cgi', 'py', 'asp', 'cfm', 'js', 'vbs', 'html', 'htm');

Utils/upload_file.php::create_stored_filename()

        // cn: bug 6347 - fix file extension detection
        foreach($sugar_config['upload_badext'] as $badExt) {
            if(strtolower($this->file_ext) == strtolower($badExt)) {
                $stored_file_name .= ".txt";
                $this->file_ext="txt";
                break; // no need to look for more
            }
        }