staff can always upload a file