[TASK] Add documentation about var folder protection with lighttpd

[jirafeau_mojo42.git] / README.md

diff --git a/README.md b/README.md
index 287fa7623ac7fa6493db03dcf65da62b87031200..752494cfbbfec91c914e4161999ad35b043eba70 100644 (file)
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ Next Release [![Build Status Next Release](https://gitlab.com/mojo42/Jirafeau/ba
 - Shortened URLs using base 64 encoding
 - Maximal upload size configurable
 - NO database, only use basic PHP
-- Simple language support :gb: :fr: :de: :it: :nl: :ro: :sk: :hu: :cn: :gr: :ru: :es: :tk: :flag_tr:
+- Simple language support :gb: :fr: :de: :it: :nl: :ro: :sk: :hu: :cn: :gr: :ru: :es: :tk: :flag_tr: :flag_pt: :flag_br:
 - File level [Deduplication](http://en.wikipedia.org/wiki/Data_deduplication) for storage optimization (does store duplicate files only once, but generate multiple links)
 - Optional data encryption
 - Small administration interface
@@ -55,6 +55,10 @@ Jirafeau project won't evolve to a file manager and will focus to keep a very fe
 
 ## Installation
 
+This shows how to install Jirafeau by your own, it's quite simple but you can
+also use a [docker image](https://hub.docker.com/r/mojo42/jirafeau/) or build
+it yourself. Check [docker folder](docker/README.md) for more informations.
+
 System requirements:
 - PHP >= 5.6
 - Optional, but recommended: Git >= 2.7
@@ -106,6 +110,11 @@ Installation steps:
 
 1. No special change to upgrade to 3.2.0
 
+### From version 3.2.0 to 3.2.1
+
+1. No special change to upgrade to 3.2.1
+
+
 ### Troubleshooting
 
 If you have some troubles, consider the following cases
@@ -134,8 +143,16 @@ location ~ /var-.* {
 }
 ```
 
+If you are using lighttpd, you can deny access to ```var``` folder in your configuration:
+
+```
+$HTTP["url"] =~ "^/var-*" {
+         url.access-deny = ("")
+}
+```
+
 You should also remove un-necessessary write access once the installation is done (ex: configuration file).
-An other obvious basic security is to let access users to the site by HTTPS.
+An other obvious basic security is to let access users to the site by HTTPS (make sure `web_root` in you `config.local.php` is set with https).
 
 ## Server side encryption
 
@@ -389,3 +406,7 @@ The very first version of Jirafeau after the fork of Jyraphe.
 - Update translations from Update translations from weblate
 - Better style
 - Fix regression on admin password setting
+
+## Version 3.2.1
+
+- fix download view after an upload