Forum OpenACS Development: Re: Temp Upload Directory Naviserver OS X
The list of valid directories is hard coded in ad_page_contract https://openacs.org/api-doc/proc-view?source_p=1&proc=ad_page_contract_filter_proc_tmpfile&version_id=
That should probably we some sort of parameter as well but it seems to have been OK for 10 years or so.
Anyhow, you are right, this should be fixed . Many thanks for the report.