Limit WeKan file size and type

attachments.js

diff --git a/models/attachments.js b/models/attachments.js
index bbbf8e59..4b7faa7c 100644
--- a/models/attachments.js
+++ b/models/attachments.js
@@ -33,6 +33,19 @@ Attachments = new FilesCollection({
     const ret = fileStoreStrategyFactory.storagePath;
     return ret;
   },
+  onBeforeUpload(file) {
+    // Allow upload files under 10MB, and only in png/jpg/jpeg formats
+    // Note: You should never trust to extension and mime-type here
+    // as this data comes from client and can be easily substitute
+    // to check file's "magic-numbers" use `mmmagic` or `file-type` package
+    // real extension and mime-type can be checked on client (untrusted side)
+    // and on server at `onAfterUpload` hook (trusted side)
+    if (file.size <= 10485760 && /png|jpe?g/i.test(file.ext)) {
+      return true;
+    }
+    alert('Please upload image, with size equal or less than 10MB');
+    return 'Please upload image, with size equal or less than 10MB';
+  },
   onAfterUpload(fileObj) {
     // current storage is the filesystem, update object and database
     Object.keys(fileObj.versions).forEach(versionName => {