This is correct, but we also need to check that the user has the permission to upload a file ...