this is may be a long-shot, but what about allowing all files from the /images/ directory and excluding images from any other directory? the assumption being that icons and other "helper" images will come from directories other than /images/.