Unofficial filemanager php connector Security

First off, both the FCKEditor and the unofficial file manager/php connector are very handy.

However, I noticed that there isn't anything preventing a user from uploading a file named file.jpg and then renaming it to file.php (with whatever php code it really contains).

Also, I tried to read a session variable from command\renamefile.php file to make sure that the user was logged in and had a particular security right before renaming files but it seems to interfere with the XML transmission?

Finally, am I right to be concerned that if a hacker knows the path to the XML connector they could do cross site file uploads (set up a form on one server that calls the XML connector on my server and posts their files)? I might have overlooked some code that makes sure its coming from the local server?

I can probably modify the rename function to prevent renaming files with banned extensions, but have about given up on the session variable part....

Any help or advice?