Python : Unsafe file upload

If users can upload files to publicly accessible directories, an attacker can use it for remote execution of malicious code on the server.

MEDIA_ROOT specifies the absolute filesystem path to the directory that will hold files uploaded by user. STATIC_ROOT specifies the absolute path to the directory where collectstatic will collect static files for deployment. MEDIA_ROOT and STATIC_ROOT must have different values.

MEDIA_URL stores the URL used to manage the stored files. MEDIA_URL and STATIC_URL must also have different values.