security commit
upload, not beautiful but working.

todo: trigger xmlparser
...