Core_Upload::clean_filename

protected function clean_filename()
{
    $filename = str_replace($this->bad_string, '', $this->file['name']);

    $this->file['name'] = stripslashes($filename);

    return $this;
}