limit allowed extensions in file upload

I need to limit the file extensions allowed to be uploaded using the file/image object. I found references to the file extensions in download.asp but no where else. Is there a way to do this in a setting or do I need to code the validation. if i need to code it where is the best place to do so

TIA

GAB