How can you Specify the Type and Size of File Attachments That Can Be Uploaded?

Use the Maxsize & Filetype option in the Addattachment function Call.

Syntax: AddAttachment(URLDestination, DirAndFilename, FileType, UserFile, MaxSize)

URLDestination - A reference to a URL. This can be either a URL name, in the form URL.URLName, or a string. This is where the file is transferred to.

DirAndFileName - A directory and filename. This is appended to the URLDestination to make up the full URL where the file is transferred to.
Note. The URLDestination requires "/" (forward) slashes. Because the DirAndFileName parameter is appended to the URL, it also requires only "/" slashes. "\" (backward) slashes are NOT supported in anyway for either the URLDestination or the DirAndFileName parameter.

FileType - A string to use as a suggestion for the extension file type, such as ".doc", ".gif", ".properties" and so on. Passing in a null string (that is, two double-quotes with no space ("")) will invoke all files (*.*)

UserFile - The name of the file on the source system.

MaxSize - Specify, in kilobytes, the maximum size of the attachment.

So, if you specify 100, that means the maximum size allowed is 100k.

The FileType parameter is only a suggestion. Specifying it does not enforce specific file types. If you do not want specific file types (such as .exe or .bat) you must write PeopleCode to discern the name and file type of the attached file and delete it.

When the end user views attachments using the ViewAttachment function, some browsers treat documents as HTML regardless of file extension, and thus execute embedded java script. You may want to write a PeopleCode program to only allow specific file extensions to be viewed.