Hi Elijah,
For your intertest...
There is basically a configurable control that inherits from the standard asp.net FileUpload control but then the input for that is replaced by javascript, so if javascript is disabled in the web browser it can still work using normal form post with the file to upload. But the javascript uses a service url which is feature specific and implemented for each feature that uses it to enforce the needs and security requirements that vary by the specific feature. So each feature has a fallback implementation to handle the upload in the page or usercontrol that would be used if javascript was disabled but generally the upload will be handled by the service url. For cms features there is a base class for the upload hander to enforce some common security logic for page and module edit permissions.
To see the bare bones of it though, there is a new web project in the source code for prototype work and I first implemented the control there, there is this example page that hosts the control as well as an example service url to handle the file upload with no security since it is only meant for proof of concept on a dev machine. This prototype web project is much more light weight than running the large mojoportal solution. There are still a few things I need to finish on the upload control before the next release though, even though I've gone ahead and replaced NeatUplaod with it.
You can test the no javascript fallback in the prototype project by putting the local dev url for it in the restricted zone in IE which blocks javascript.
The css for this was added to the /Data/style/common/style.css
Best,
Joe