Role-Based Upload Permissions
This endpoint applies different rules by role. Sign in as User to see the image-only 2 MB policy, then switch to Admin to allow larger or non-image uploads.
What you should see: the upload endpoint is gated by role, so who may upload is decided on the server rather than by hiding a button in the browser.
Checking current session...
Sign in as User and try a PDF to see a role-based rejection, or sign in as Admin to allow it.
Server Rules
User: images only (.jpg, .png, .gif, .webp) and up to 2 MB.
Admin: unrestricted for this demo endpoint.
CoreUpload.create('#role-uploader', {
uploadUrl: '/demo/security/role-upload',
autoUpload: true
});