Your default file upload location is under the administrator/ like: administrator/components/com_xxx/yyy
Why not make it media/com_xxx/yyy ?
Because when I use Admin Tools (from Akeeba) to set a htaccess on the administrator directory (which I always do nowadays for extra security) the files under administrator/components/com_xxx/yyy are not accessible by the front-end users.
We use cookies so that you can place orders and we can provide a better service. You can control the use of cookies at the individual browser level. If you reject cookies, you may still use our website, but your ability to use some features or areas of our website may be limited.