Managed to track post uploads down to this exact line:
in particular,
// relative urls
if (/^\/[\w\.\-]+/i.test(href)) {
return href;
}
breaks because since my forum URL is being served out of an apache user-webdir (which I don’t have control over), it starts with a ~, which breaks that regex.
I’ve confirmed that modifying the character class to include ~ (as [\w\.\-~]) fixes the post uploads, but painfully avatar uploads are still broken!