is it possible to restrict uploading of attachments in posts to just staff?
Yes, you’re looking for the authorized extensions and authorized extensions for staff settings (admin > site settings). It’s a matter of adding/removing the file types you want to support.
Thanks! You guys are the best and most responsive team I have ever worked with!