public function upload(Request $request)
{
    $file = $_FILES['file'];  // SOURCE: User input ([line 13](https://plugins.trac.wordpress.org/browser/alex-reservations/trunk/includes/application/Alexr/Http/Controllers/UploadFileController.php#L13))
    
    // Target dir / url
    $upload_dir = wp_upload_dir();
    $date = evavel_date_now()->format('Y/m');
    $base_dir = $upload_dir['basedir'].'/'.ALEXR_UPLOAD_FOLDER.'/'.$date;
    $base_url = $upload_dir['baseurl'].'/'.ALEXR_UPLOAD_FOLDER.'/'.$date;

    if (!file_exists($base_dir)) {
        $folder_created = wp_mkdir_p($base_dir);
        if (!$folder_created) {
            return $this->response([
                'success' => false,
                'error' => __eva('Error creating folder.')
            ]);
        }
    }

    $file_name = $file['name'];
    $file_name = preg_replace('/[^a-z0-9_\.\-[:space:]]/i', '_', $file_name);  // Only basic sanitization ([line 50](https://plugins.trac.wordpress.org/browser/alex-reservations/trunk/includes/application/Alexr/Http/Controllers/UploadFileController.php#L50))

    $target_dir_file = $base_dir.'/'.$file_name;
    $target_url_file = $base_url.'/'.$file_name;

    $result = copy($file['tmp_name'], $target_dir_file);  // SINK: Direct file copy ([line 38](https://plugins.trac.wordpress.org/browser/alex-reservations/trunk/includes/application/Alexr/Http/Controllers/UploadFileController.php#L38))

    if (!$result) {
        return $this->response([
            'success' => false,
            'error' => __eva('Error saving file.')
        ]);
    }

    return $this->response([
        'success' => true,
        'file_path' => $target_dir_file,
        'file_url' => $target_url_file,
        'message' => __eva('Uploaded.')
    ]);
}