Update README.md

[uguu.git] / README.md

diff --git a/README.md b/README.md
index eaf0ac58d5aa9613d11d43e3ba25c459973c12df..8afc8a8951f3fa1b51385b463e1db6f469a50a2e 100644 (file)
--- a/README.md
+++ b/README.md
@@ -20,8 +20,8 @@ See the real world example at [uguu.se](https://uguu.se).
 
 ## Requirements
 
-Original development environment is Nginx + PHP7.3 + SQLite, but is confirmed to
-work with Apache 2.4 and newer PHP versions.
+Original development environment is Nginx + PHP5.3 + SQLite, but is confirmed to
+work with Apache 2.4 and newer PHP versions like PHP7.3.
 
 ## Install
 
@@ -83,6 +83,16 @@ Then add them to your crontab:
 
 These scripts check if DB entries and files are older then 24 hours and if they are deletes them.
 
+## MIME/EXT Blocking
+
+Blocking certain filetypes from being uploaded can be changed by editing the following settings in `static/php/includes/settings.inc.php`:
+```php
+define('CONFIG_BLOCKED_EXTENSIONS', serialize(['exe', 'scr', 'com', 'vbs', 'bat', 'cmd', 'htm', 'html', 'jar', 'msi', 'apk', 'phtml']));
+define('CONFIG_BLOCKED_MIME', serialize(['application/msword', 'text/html', 'application/x-dosexec', 'application/java', 'application/java-archive', 'application/x-executable', 'application/x-mach-binary']));
+```
+
+By default the most common malicious filetypes are blocked.
+
 ## Using SQLite as DB engine
 
 We need to create the SQLite database before it may be used by uguu.
@@ -106,15 +116,9 @@ define('UGUU_DB_PASS', '[stuff]'); ---> define('UGUU_DB_PASS', null);
 
 *NOTE: The directory where the SQLite database is stored, must be writable by the web server user*
 
-### Apache
-
-If you are running Apache and want to compress your output when serving files,
-add to your `.htaccess` file:
-
-    AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/x-javascript application/json
+### Nginx/Apache
 
-Remember to enable `deflate_module` and `filter_module` modules in your Apache
-configuration file.
+I won't cover settings everything up, however do NOT allow PHP scripts to be executed on your subdomain serving the files or someone will just upload a PHP shell and PwN you.
 
 ## Getting help