all uploaded files are made public