Saving upload in Flask only saves to project root

When I upload a new file, it saves to the application root folder, even though I specified a different UPLOAD_FOLDER. Why doesn't the config work?

views.py:

from flask import render_template
from flask import request, redirect, url_for,flash
from werkzeug.utils import secure_filename
from app import app
import os

APP_ROOT = os.path.dirname(os.path.abspath(__file__))
UPLOAD_FOLD = '/Users/blabla/Desktop/kenetelli/htmlfi'
UPLOAD_FOLDER = os.path.join(APP_ROOT, UPLOAD_FOLD)
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER

@app.route('/')
def tmrf():
    return render_template('main.html')


@app.route('/uploader', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        f.save(secure_filename(f.filename))
    return 'file uploaded successfully'

__init__.py:

from flask import Flask

UPLOAD_FOLDER = ''
ALLOWED_EXTENSIONS = set('*.doc')

app = Flask(__name__)
app.config.from_object('config')
from app import views

Solution 1:

UPLOAD_FOLDER is not a configuration option recognized by Flask. f.save works relative to the current working directory, which is typically the project root during development.

Join the secured filename to the upload folder, then save to that path.

f.save(os.path.join(app.config['UPLOAD_FOLDER'], secure_filename(f.filename)))

It's better to store local data in the instance folder, not the project root. Flask already knows where that is. Just make sure you create the instance directory first.

import os
from werkzeug.utils import secure_filename

# create the folders when setting up your app
os.makedirs(os.path.join(app.instance_path, 'htmlfi'), exist_ok=True)

# when saving the file
f.save(os.path.join(app.instance_path, 'htmlfi', secure_filename(f.filename)))

No matter where you decide to save it, you need to make sure the user running the application has write permission to that directory. If you get permission errors when running with mod_wsgi, for example, the user is commonly httpd or www-data. If you get a permission denied error, check that.