If you want to make all files public accessible then you can add an upload folder to the public folder, it will then be directly accessible. If you want to protect the uploaded files, prevent public access to it then leave it outside the public folder. When outside the public folder you will need to create a server connect action for the download, in that you can also have steps to track downloads, access security etc.