diff --git a/lib/dbh/dbh.class.php b/lib/dbh/dbh.class.php
index 1e8556cc88..44c1f95ff4 100644
--- a/lib/dbh/dbh.class.php
+++ b/lib/dbh/dbh.class.php
@@ -987,8 +987,8 @@ class dbh
      */
     public function checkUserPriv(): string
     {
-        global $dbConfig;
-        if(!in_array($this->dbConfig->driver, $dbConfig->mysqlDriverList)) return '';
+        global $config;
+        if(!in_array($this->dbConfig->driver, $config->mysqlDriverList)) return '';
 
         $dbName = $this->dbConfig->name;
         $user   = $this->dbConfig->user;
diff --git a/module/transfer/control.php b/module/transfer/control.php
index bcc2487993..ca391754d5 100755
--- a/module/transfer/control.php
+++ b/module/transfer/control.php
@@ -102,7 +102,9 @@ class transfer extends control
             $file = $this->loadModel('file')->getUpload('file');
             if(!empty($file['error'])) return $this->send(array('result' => 'fail', 'message' => $this->lang->file->uploadError[$file['error']]));
 
-            $file      = $file[0];
+            $file = $file[0];
+            if(!in_array(strtolower($file['extension']), array('xls', 'xlsx'))) return $this->send(array('result' => 'fail', 'message' => $this->lang->excel->canNotRead));
+
             $shortName = $this->file->getSaveName($file['pathname']);
             if(empty($shortName)) return $this->send(array('result' => 'fail', 'message' => $this->lang->excel->emptyFileName));