In the default conf, only authenticated users (sme accounts, either throuh http basic auth or Lemonldap::NG) can upload files. For external people, they can upload only if they first get a grant from an authenticated user, a grant is only avaliable once, and uploaded files are scanned with ClamAV before being accepted. Of course only the grantor can then retrieve a file uploaded by an external user.