In the latest version this is managed from Site Settings > Security > Permissions.
Admins can upload anywhere starting from /Data/Sites/[SiteID]/
but users added in roles configured for Roles that can upload and browse can only upload starting at /Data/Sites/[SiteID]/media/
this folder will be created if it does not exist the first time a user in those roles tries to browse the server.
There is also a more restrictive one, Roles that can browse and upload but only in a user specific location.
users in those roles can browse and upload starting at /Data/Sites/[SiteID]/userfiles/[UserID]/
again the folder will be created on demand when a user in these roles tries to browse.
Users can create folders beneath these starting points to organize files.
Hope it helps,