This won't work. By prepending the applicationDataDirectory, you're disallowing someone to save the response to the tempDirectory.

Furthermore, you're forcing someone to enter a non-fully qualified path for the "file" property which conflicts with the default behavior for non-fully qualified paths. Non-fully qualified paths default to the Resources directory, which isn't writable anyways.

And if someone passes in a fully qualified path that is in the applicationDataDirectory, it will be set twice and error as an invalid path.