correct business logic for uploadFile, not tested