move upload to products controller