staff can always upload a file

app/assets/javascripts/discourse/components/utilities.js

@@ -194,7 +194,8 @@ Discourse.Utilities = {
 
     @method validateUploadedFile
     @param {File} file The file to be uploaded
-    @param {string} type The type of the file
+    @param {string} type The type of the upload (image, attachment)
+    @returns true whenever the upload is valid
   **/
   validateUploadedFile: function(file, type) {
     // check that the uploaded file is authorized
@@ -205,7 +206,7 @@ Discourse.Utilities = {
     }
 
     // ensures that new users can upload a file
-    if (Discourse.User.currentProp('trust_level') === 0 && Discourse.SiteSettings['newuser_max_' + type + 's'] === 0) {
+    if (!Discourse.User.current().isAllowedToUploadAFile(type)) {
       bootbox.alert(I18n.t('post.errors.' + type + '_upload_not_allowed_for_new_user'));
       return false;
     }

app/assets/javascripts/discourse/models/draft.js

@@ -11,7 +11,7 @@ Discourse.Draft = Discourse.Model.extend({});
 Discourse.Draft.reopenClass({
 
   clear: function(key, sequence) {
-    return Discourse.ajax("/draft", {
+    return Discourse.ajax("/draft.json", {
       type: 'DELETE',
       data: {
         draft_key: key,
@@ -21,20 +21,20 @@ Discourse.Draft.reopenClass({
   },
 
   get: function(key) {
-    return Discourse.ajax('/draft', {
+    return Discourse.ajax('/draft.json', {
       data: { draft_key: key },
       dataType: 'json'
     });
   },
 
   getLocal: function(key, current) {
-    var local;
+    // TODO: implement this
     return current;
   },
 
   save: function(key, sequence, data) {
     data = typeof data === "string" ? data : JSON.stringify(data);
-    return Discourse.ajax("/draft", {
+    return Discourse.ajax("/draft.json", {
       type: 'POST',
       data: {
         draft_key: key,

app/assets/javascripts/discourse/models/user.js

@@ -276,6 +276,19 @@ Discourse.User = Discourse.Model.extend({
       type: 'PUT',
       data: { use_uploaded_avatar: useUploadedAvatar }
     });
+  },
+
+  /**
+    Determines whether the current user is allowed to upload a file.
+
+    @method isAllowedToUploadAFile
+    @param {string} type The type of the upload (image, attachment)
+    @returns true if the current user is allowed to upload a file
+  **/
+  isAllowedToUploadAFile: function(type) {
+    return this.get('staff') ||
+           this.get('trust_level') > 0 ||
+           Discourse.SiteSettings['newuser_max_' + type + 's'] > 0;
   }
 
 });