In the config file, 2/3 way down, for 'AllowedExtensions', 'DissalowedExtensions'.
Default setting is :
'allowedExtensions' => array(), // an array of allowed file extensions
'disallowEdextensions' => array('php', 'php3', 'php4', 'php5'), // an array of disallowed file extensions
My settings :
'allowedExtensions' => array('pdf'), // an array of allowed file extensions
'disallowEdextensions' => array('php', 'php3', 'php4', 'php5', 'exe', 'bat'), // an array of disallowed file extensions
This Post was from: https://www.impresscms.org/iforum/viewtopic.php?topic_id=4480&post_id=40152