Restricting upload file types

Hi, I’m running WP 2.0.5 and I recently opened up user registration so that readers could submit articles to my site. I also am permitting them to upload images to their articles.

However, people started uploading enormous BMPs instead of the desired .jpg/.gif/.png. I was surprised to find my install of WP doesn’t have any limitation on file size or even type whatsoever. I was able to upload a .php file and an .exe file.

How can I restrict uploads to be a specific file type, and stay below a defined size? Thanks.