Earlier quoted context omitted.
> Having restrictions on filetypes is a bug, not a feature. It should be - but for many school IT security types it really is a feature to limit file types
I fought this during my entire teaching career. Blocking file types by extension is pointless. as you can just change the file type. If you're worried about kids being able to run arbitrary python scripts on your network, then the security problem is not the kids, it's your shitty network. People are given cash as bug bounties for finding security flaws in systems, but in schools they are punished!
How is this even possible? Unless your CMS runs on python somewhere and does eval() a lot. Then yes, that is a huge problem. Moreover, why would that stop anything just not called .\+\.py?
If your CMS does `python ${fileIjustdownloadedfromuser}` in a shell then we are in serious trouble.