upload function ok, lack of sesseion control
delete uploaded pictures