diff --git a/files/src/main/java/de/srsoftware/umbrella/files/FileModule.java b/files/src/main/java/de/srsoftware/umbrella/files/FileModule.java
index c2abcba..9c3cf0c 100644
--- a/files/src/main/java/de/srsoftware/umbrella/files/FileModule.java
+++ b/files/src/main/java/de/srsoftware/umbrella/files/FileModule.java
@@ -13,6 +13,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.sun.net.httpserver.HttpExchange;
 import de.srsoftware.configuration.Configuration;
+import de.srsoftware.tools.MimeType;
 import de.srsoftware.tools.Path;
 import de.srsoftware.tools.SessionToken;
 import de.srsoftware.umbrella.core.BaseHandler;
@@ -23,9 +24,8 @@ import de.srsoftware.umbrella.core.model.Company;
 import de.srsoftware.umbrella.core.model.Project;
 import de.srsoftware.umbrella.core.model.Token;
 import de.srsoftware.umbrella.core.model.UmbrellaUser;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
+
+import java.io.*;
 import java.net.URLDecoder;
 import java.nio.file.Files;
 import java.util.HashMap;
@@ -205,7 +205,43 @@ public class FileModule extends BaseHandler implements FileService {
 	}
 
 	private boolean postProjectDirectory(Path path, HttpExchange ex, UmbrellaUser user) throws IOException {
-		return false;
+		var prjId = path.pop();
+		var projects = projectService();
+		if (prjId == null){
+			var projectList = projects.listUserProjects(user.id(),true);
+			var map = projectList.values().stream().collect(Collectors.toMap(prj -> "/project/"+prj.id(),Project::name));
+			return sendContent(ex,Map.of("dirs",map));
+		}
+
+		long pid;
+		try {
+			pid = Long.parseLong(prjId);
+		} catch (NumberFormatException e) {
+			throw invalidFieldException(PROJECT_ID,"Long");
+		}
+		var project = projects.loadMembers(projects.load(pid));
+		var filename = "/project/"+pid;
+		if (!path.empty()) filename += "/"+URLDecoder.decode(path.toString(),UTF_8);
+		if (!project.hasMember(user) && !fileDb.isPermitted(user,filename)) throw forbidden("You are not allowed to access {0}",filename);
+		var file = new File(baseDir+filename);
+		if (contentType(ex).isPresent()) { // file upload
+			var out = new FileOutputStream(file);
+			var body = ex.getRequestBody();
+			body.transferTo(out);
+			body.close();
+			out.close();
+		} else {
+			if (file.exists()) throw unprocessable("{0} already exists!", filename);
+			try {
+				file.mkdirs();
+			} catch (Exception e) {
+				throw unprocessable("Failed to create {0}", filename);
+			}
+		}
+		Map<String,Object> map = getDirectory(file.getParentFile());
+		map.put("title",filename);
+		return sendContent(ex,map);
+
 	}
 
 	private boolean postUserDirectory(Path path, HttpExchange ex, UmbrellaUser user) throws IOException {
@@ -221,18 +257,19 @@ public class FileModule extends BaseHandler implements FileService {
 		if (!path.empty()) filename += "/"+URLDecoder.decode(path.toString(),UTF_8);
 		if (uid != user.id() && !fileDb.isPermitted(user,filename)) throw forbidden("You are not allowed to access {0}",filename);
 		var file = new File(baseDir+filename);
-		var contentType = contentType(ex).orElse(null);
-		if (MIME_FORM_DATA.equals(contentType)) { // file upload
-			// TODO: create parent directory if it does not exist
-			// TODO: create file and write content
-			return false;
-		}
-
-		if (file.exists()) throw unprocessable("{0} already exists!",filename);
-		try {
-			file.mkdirs();
-		} catch (Exception e) {
-			throw unprocessable("Failed to create {0}",filename);
+		if (contentType(ex).isPresent()) { // file upload
+			var out = new FileOutputStream(file);
+			var body = ex.getRequestBody();
+			body.transferTo(out);
+			body.close();
+			out.close();
+		} else {
+			if (file.exists()) throw unprocessable("{0} already exists!", filename);
+			try {
+				file.mkdirs();
+			} catch (Exception e) {
+				throw unprocessable("Failed to create {0}", filename);
+			}
 		}
 		Map<String,Object> map = getDirectory(file.getParentFile());
 		map.put("title",filename);
diff --git a/frontend/src/routes/files/Index.svelte b/frontend/src/routes/files/Index.svelte
index 3e3a9c0..0920d81 100644
--- a/frontend/src/routes/files/Index.svelte
+++ b/frontend/src/routes/files/Index.svelte
@@ -42,8 +42,7 @@
             method: 'POST'
         });
         if (res.ok) {
-            yikes();
-            loadChildren(window.location.pathname);
+            handleDirectory(res);
             new_dir = null;
         } else {
             error(res);
@@ -51,6 +50,14 @@
         return false;
     }
 
+    async function handleDirectory(res){
+        let json = await res.json();
+        if (json.dirs)  children.dirs  = json.dirs;
+        if (json.files) children.files = json.files;
+        if (json.title) children.title = json.title;
+        yikes();
+    }
+
     async function loadChildren(p){
         p = p.substring(6);
         if (p == '') p = '/';
@@ -67,14 +74,10 @@
             const url = api(`files${p}`);
             const res = await fetch(url,{credentials:'include'});
             if (res.ok){
-                let json = await res.json();
-                if (json.dirs) children.dirs = json.dirs;
-                if (json.files) children.files = json.files;
-                if (json.title) children.title = json.title;
                 parent = p.substring(0, p.lastIndexOf("/"));
                 if (parent == '/user'||p=='/project'||p=='/company') parent = '/';
                 form = !(p=='/company'||p=='/project'||p=='/user');
-                yikes();
+                handleDirectory(res);
             } else {
                 error(res);
             }
@@ -98,18 +101,18 @@
 
     async function upload_file(ev){
         ev.preventDefault();
-        console.log(files);
-        const dataArray = new FormData();
-        dataArray.append("uploadFile", files);
-        const url =  api('files'+path);
-        const resp = fetch(url, {
+        const url =  api('files'+path+'/'+files[0].name);
+        const resp = await fetch(url, {
             credentials: 'include',
             method: 'POST',
-            headers: [["Content-Type", "multipart/form-data"]],
-            body: dataArray
+             headers: {
+                "Content-Type": "application/unknown",
+            },
+            body: files[0]
         });
         if (resp.ok){
-            yikes();
+            handleDirectory(resp);
+            files = null;
         } else {
             error(resp);
         }