move uploads from html to xoops_trust_path