Olha's route is a fair one. A forms app that runs regex or an extension check on the attachment field is one of the few ways to enforce a file-type rule, so that's a sound direction.
The piece missing from the thread is the native side. Out of the box, JSM Cloud forms give you no way to limit an attachment field to certain extensions. The field takes any file type and there's no allow/deny list to point it at. Atlassian tracks this as JRACLOUD-61024 and has said they won't build it in the near term, so it isn't arriving as a native setting any time soon.
Size sits in the same bucket. The maximum attachment size is a single site-wide value an admin sets under Settings > System > Advanced > Attachments, and it covers every attachment on the instance. There's no way to give one form field or one file type its own smaller cap.
So both of your requirements sit outside what the platform does on its own, which is why the Marketplace is where this lands. Smart Forms is one option; any forms/validation app that can check the attachment field against an allowed-extension pattern will do the same job.
If you'd rather stay off an app, the one native lever is an automation rule on request creation that deletes any attachment whose filename doesn't end in your allowed extensions (.pdf, .jpg, .png, .bmp). It only runs once the request exists, so the file uploads first and then gets stripped, and it does nothing for the size limit, so it's a partial fix at most.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.