From what I understand the uploadToken limits the end-user to uploading files only to their account (and not the master account), if the token is obtained using a child account credentials.

However, the token doesn't incorporate any aspect of the destFolderPath, so can't the destFolderPath be tampered with on a browser-based http post (aka stick the file somewhere else in the account)? Is there any way to prevent this?

Thanks,

 Adam
 

You are correct that the destination path can be changed in the case of http uploads.  For now this isn't a destructive problem since there is no overwrite on uploads, but this will be given a high priority. We would need to add the path as part of the the token generation.  The only way to avoid this problem for now is to proxy the uploads through your own server.

I will suggest this addition to enhance the upload security right away.

Thanks,
    Barry R.