diff --git a/templates/file_upload_progress_page.html b/templates/file_upload_progress_page.html
index a6c90ea36e..1130319f3a 100644
--- a/templates/file_upload_progress_page.html
+++ b/templates/file_upload_progress_page.html
@@ -5,10 +5,9 @@
     // Update progress bar
     function update_progress_info() {
         $.ajax({
-            url: '{{ SITE_ROOT }}file_upload_progress/?X-Progress-ID=' + '{{ uuid }}', 
-            dataType: 'json',
+            url: '{{ httpserver_root }}/upload_progress/?X-Progress-ID=' + '{{ uuid }}' + '&callback=?', 
+            dataType: 'jsonp',
             cache: false,
-            contentType: 'application/json; charset=utf-8',
             success: function(data) {
                 if (data) {
                     $('#upload-progress-text', window.parent.document).html(filesizeformat(data.uploaded) + ' / ' +  filesizeformat(data.length));
diff --git a/templates/repo_update_file.html b/templates/repo_update_file.html
index 35c9fad536..2a16fffa3e 100644
--- a/templates/repo_update_file.html
+++ b/templates/repo_update_file.html
@@ -13,7 +13,7 @@
               {% endif %}
             {% endfor %}
     </h3>
-    <form id="upload-file-form" enctype="multipart/form-data" method="post">
+    <form id="upload-file-form" enctype="multipart/form-data" method="post" action="{{ update_url }}">
         <input type="hidden" name="target_file" value="{{ target_file }}" />
         <input type="file" name="file" id="file" />
         <p>(文件应小于 {{ max_upload_file_size|filesizeformat }})</p>
@@ -45,9 +45,6 @@ function gen_uuid() {
     return uuid;
 }
 
-// NOTE: In order to real time show upload progress, we must deploy seahub in
-// ngnix or gunicorn, since we need more than one seahub process to be
-// running: one for receiving file, one for handling ajax request.
 function submit_and_real_time_show () {
     var form = $('#upload-file-form')[0],
         uuid = gen_uuid(); // id for this upload so we can fetch progress info.
@@ -61,10 +58,9 @@ function submit_and_real_time_show () {
     // Update progress bar: not work in chrome. for ff.
     function update_progress_info() {
         $.ajax({
-            url: '{{ SITE_ROOT }}file_upload_progress/?X-Progress-ID=' + uuid, 
-            dataType: 'json',
+            url: '{{ httpserver_root }}/upload_progress/?X-Progress-ID=' + uuid + '&callback=?', 
+            dataType: 'jsonp',
             cache: false,
-            contentType: 'application/json; charset=utf-8',
             success: function(data) {
                 if (data) {
                     $('#upload-progress-text').html(filesizeformat(data.uploaded) + ' / ' +  filesizeformat(data.length));
diff --git a/templates/repo_upload_file.html b/templates/repo_upload_file.html
index c4fe056857..1de5e7d9c7 100644
--- a/templates/repo_upload_file.html
+++ b/templates/repo_upload_file.html
@@ -9,7 +9,7 @@
             <a href="{{ SITE_ROOT }}repo/{{ repo.id }}/?p={{ link|urlencode }}">{{ name }}</a> / 
             {% endfor %}
     </h3>
-    <form id="upload-file-form" enctype="multipart/form-data" method="post">
+    <form id="upload-file-form" enctype="multipart/form-data" method="post" action="{{ upload_url }}">
         <input type="hidden" name="parent_dir" id="parent_dir" value="{{ parent_dir }}" />
         <input type="file" name="file" id="file" />
         <p>(文件应小于 {{ max_upload_file_size|filesizeformat }})</p>
@@ -41,9 +41,6 @@ function gen_uuid() {
     return uuid;
 }
 
-// NOTE: In order to real time show upload progress, we must deploy seahub in
-// ngnix or gunicorn, since we need more than one seahub process to be
-// running: one for receiving file, one for handling ajax request.
 function submit_and_real_time_show () {
     var form = $('#upload-file-form')[0],
         uuid = gen_uuid(); // id for this upload so we can fetch progress info.
@@ -57,10 +54,9 @@ function submit_and_real_time_show () {
     // Update progress bar: not work in chrome. for ff.
     function update_progress_info() {
         $.ajax({
-            url: '{{ SITE_ROOT }}file_upload_progress/?X-Progress-ID=' + uuid, 
-            dataType: 'json',
+            url: '{{ httpserver_root }}/upload_progress/?X-Progress-ID=' + uuid + '&callback=?', 
+            dataType: 'jsonp',
             cache: false,
-            contentType: 'application/json; charset=utf-8',
             success: function(data) {
                 if (data) {
                     $('#upload-progress-text').html(filesizeformat(data.uploaded) + ' / ' +  filesizeformat(data.length));
diff --git a/urls.py b/urls.py
index f3a0858022..e4099c4131 100644
--- a/urls.py
+++ b/urls.py
@@ -9,7 +9,7 @@ from seahub.views import root, myhome, \
     user_info, repo_set_access_property, repo_access_file, \
     repo_remove_share, repo_download, org_info, repo_view_file, pdf_full_view, \
     seafile_access_check, repo_history_changes, \
-    repo_upload_file, file_upload_progress, file_upload_progress_page, \
+    repo_upload_file, file_upload_progress_page, \
     get_subdir, file_move, repo_new_dir, repo_new_file, repo_rename_file, validate_filename, \
     repo_create, repo_update_file, file_revisions, \
     get_shared_link, view_shared_file, remove_shared_link, send_shared_link, \
@@ -49,7 +49,6 @@ urlpatterns = patterns('',
     (r'^sharedlink/send/$', send_shared_link),
     (r'^f/(?P<token>[^/]+)/$', view_shared_file),
                        
-    (r'^file_upload_progress/$', file_upload_progress),
     (r'^file_upload_progress_page/$', file_upload_progress_page),
     (r'^repo/new_dir/$', repo_new_dir),
     (r'^repo/new_file/$', repo_new_file),
diff --git a/utils.py b/utils.py
index 3c86b7fde5..17f3b893cb 100644
--- a/utils.py
+++ b/utils.py
@@ -293,6 +293,9 @@ def gen_file_get_url(token, filename):
     """
     return '%s/files/%s/%s' % (get_httpserver_root(), token, filename)
 
+def gen_file_upload_url(token, op):
+    return '%s/%s/%s' % (get_httpserver_root(), op, token)
+
 def get_ccnet_server_addr_port():
     """get ccnet server host and port"""
     return CCNET_SERVER_ADDR, CCNET_SERVER_PORT
diff --git a/views.py b/views.py
index 47c2ab0434..4aaf3c2583 100644
--- a/views.py
+++ b/views.py
@@ -48,7 +48,8 @@ from utils import render_permission_error, render_error, list_to_string, \
     calculate_repo_last_modify, valid_previewed_file, \
     check_filename_with_rename, get_accessible_repos, EMPTY_SHA1, \
     get_file_revision_id_size, get_ccnet_server_addr_port, \
-    gen_file_get_url, string2list, set_cur_ctx, MAX_INT
+    gen_file_get_url, string2list, set_cur_ctx, MAX_INT, \
+    gen_file_upload_url
 from seahub.profile.models import Profile
 try:
     from settings import CROCODOC_API_TOKEN
@@ -255,149 +256,68 @@ def repo_upload_file(request, repo_id):
     repo = get_repo(repo_id)
     total_space = settings.USER_TOTAL_SPACE
     used_space = seafserv_threaded_rpc.get_user_quota_usage(request.user.username)
-    ############ GET ############
     if request.method == 'GET':
         parent_dir  = request.GET.get('p', '/')
         zipped = gen_path_link (parent_dir, repo.name)
+
+        token = ''        
+        if access_to_repo(request, repo_id, ''):
+            token = gen_token()
+            seafserv_rpc.web_save_access_token(token, repo_id,
+                                               'dummy', 'upload',
+                                               request.user.username)
+        else:
+            render_permission_error(request, '无法访问该目录')
+
+        upload_url = gen_file_upload_url(token, 'upload')
+        httpserver_root = get_httpserver_root()
+
         # TODO: per user quota, org user quota
         return render_to_response ('repo_upload_file.html', {
             "repo": repo,
+            "upload_url": upload_url,
+            "httpserver_root": httpserver_root,
             "parent_dir": parent_dir,
             "used_space": used_space,
             "total_space": total_space,
             "zipped": zipped,
             "max_upload_file_size": settings.MAX_UPLOAD_FILE_SIZE,
             }, context_instance=RequestContext(request))
-        
-    ############ POST ############
-    parent_dir = request.POST.get('parent_dir', '/')
-    def render_upload_error(error_msg):
-        zipped = gen_path_link (parent_dir, repo.name)
-        return render_to_response ('repo_upload_file.html', {
-            "error_msg": error_msg,
-            "repo": repo,
-            "used_space": used_space,
-            "total_space": total_space,
-            "zipped": zipped,
-            "parent_dir": parent_dir,
-            "max_upload_file_size": settings.MAX_UPLOAD_FILE_SIZE,
-            }, context_instance=RequestContext(request))
-        
-    try:
-        tmp_file = request.FILES['file']
-    except:
-        error_msg = u'请选择一个文件'
-        return render_upload_error(error_msg)
-
-    tmp_file_path = tmp_file.temporary_file_path()
-    if not os.access(tmp_file_path, os.F_OK):
-        error_msg = u'上传文件失败'
-        return render_upload_error(error_msg)
-
-    def remove_tmp_file():
-        try:
-            os.remove(tmp_file.temporary_file_path())
-        except:
-            pass
-
-    # rename the file if there is name conflicts
-    filename = check_filename_with_rename(repo_id, parent_dir, tmp_file.name)
-    if len(filename) > settings.MAX_UPLOAD_FILE_NAME_LEN:
-        remove_tmp_file()
-        error_msg = u"您上传的文件名称太长"
-        return render_error(request, error_msg)
-
-    if tmp_file.size > settings.MAX_UPLOAD_FILE_SIZE:
-        error_msg = u"您上传的文件太大"
-        remove_tmp_file()
-        return render_error(request, error_msg)
-
-    try:
-        seafserv_threaded_rpc.post_file (repo_id, tmp_file_path, parent_dir,
-                                         filename, request.user.username);
-    except SearpcError, e:
-        remove_tmp_file()
-        error_msg = e.msg
-        return render_upload_error(error_msg)
-    else:
-        remove_tmp_file()
-        url = reverse('repo', args=[repo_id]) + ('?p=%s' % parent_dir)
-        return HttpResponseRedirect(url)
 
 @login_required
 def repo_update_file(request, repo_id):
     repo = get_repo(repo_id)
     total_space = settings.USER_TOTAL_SPACE
     used_space = seafserv_threaded_rpc.get_user_quota_usage(request.user.username)
-    ############ GET ############
     if request.method == 'GET':
         target_file  = request.GET.get('p')
         if not target_file:
             return render_error(request)
         zipped = gen_path_link (target_file, repo.name)
+
+        token = ''        
+        if access_to_repo(request, repo_id, ''):
+            token = gen_token()
+            seafserv_rpc.web_save_access_token(token, repo_id,
+                                               'dummy', 'update',
+                                               request.user.username)
+        else:
+            render_permission_error(request, '无法访问该目录')
+
+        update_url = gen_file_upload_url(token, 'update')
+        httpserver_root = get_httpserver_root()
+
         # TODO: per user quota, org user quota
         return render_to_response ('repo_update_file.html', {
             "repo": repo,
+            "update_url": update_url,
+            "httpserver_root": httpserver_root,
             "target_file": target_file,
             "used_space": used_space,
             "total_space": total_space,
             "zipped": zipped,
             "max_upload_file_size": settings.MAX_UPLOAD_FILE_SIZE,
             }, context_instance=RequestContext(request))
-        
-    ############ POST ############
-    target_file = request.POST.get('target_file')
-    if not target_file:
-        return render_error(request)
-
-    def render_update_file_error(error_msg):
-        zipped = gen_path_link (target_file, repo.name)
-        return render_to_response ('repo_update.html', {
-            "error_msg": error_msg,
-            "repo": repo,
-            "used_space": used_space,
-            "total_space": total_space,
-            "zipped": zipped,
-            "target_file": target_file,
-            "max_upload_file_size": settings.MAX_UPLOAD_FILE_SIZE,
-            }, context_instance=RequestContext(request))
-        
-    try:
-        tmp_file = request.FILES['file']
-    except:
-        error_msg = u'请选择一个文件'
-        return render_update_file_error(error_msg)
-
-    tmp_file_path = tmp_file.temporary_file_path()
-    if not os.access(tmp_file_path, os.F_OK):
-        error_msg = u'上传文件失败'
-        return render_update_file_error(error_msg)
-
-    def remove_tmp_file():
-        try:
-            os.remove(tmp_file.temporary_file_path())
-        except:
-            pass
-
-    if tmp_file.size > settings.MAX_UPLOAD_FILE_SIZE:
-        error_msg = u"您上传的文件太大"
-        remove_tmp_file()
-        return render_error(request, error_msg)
-
-    parent_dir = os.path.dirname(target_file)
-    filename   = os.path.basename(target_file)
-
-    try:
-        seafserv_threaded_rpc.put_file (repo_id, tmp_file_path, parent_dir,
-                                         filename, request.user.username);
-    except SearpcError, e:
-        remove_tmp_file()
-        error_msg = e.msg
-        return render_update_file_error(error_msg)
-    else:
-        remove_tmp_file()
-        url = reverse('repo', args=[repo_id]) + ('?p=%s' % parent_dir)
-        return HttpResponseRedirect(url)
     
 def get_subdir(request):
     repo_id = request.GET.get('repo_id', '')
@@ -1462,24 +1382,6 @@ def org_info(request):
             'groups': groups,
             }, context_instance=RequestContext(request))
 
-@login_required    
-def file_upload_progress(request):
-    """
-    Return JSON object with information about the progress of an upload.
-    """
-    progress_id = None
-    if 'X-Progress-ID' in request.GET:
-        progress_id = request.GET['X-Progress-ID']
-    elif 'X-Progress-ID' in request.META:
-        progress_id = request.META['X-Progress-ID']
-
-    if progress_id:
-        cache_key = "%s_%s" % (request.user.username, progress_id)
-        data = cache.get(cache_key)
-        return HttpResponse(json.dumps(data))
-    else:
-        return HttpResponseServerError('Server Error: You must provide X-Progress-ID header or query param.')
-
 @login_required
 def file_upload_progress_page(request):
     '''
@@ -1487,9 +1389,11 @@ def file_upload_progress_page(request):
 
     '''
     uuid = request.GET.get('uuid', '')
+    httpserver_root = get_httpserver_root()
 
     return render_to_response('file_upload_progress_page.html', {
         'uuid': uuid,
+        'httpserver_root': httpserver_root,
             }, context_instance=RequestContext(request))
 
 @login_required