diff --git a/webservice/upload.php b/webservice/upload.php
index 93310cdf357..03503b274db 100644
--- a/webservice/upload.php
+++ b/webservice/upload.php
@@ -68,6 +68,11 @@ if ($fileuploaddisabled) {
 $context = context_user::instance($USER->id);
 require_capability('moodle/user:manageownfiles', $context);
 
+if ($filearea !== 'private' and $filearea !== 'draft') {
+    // Do not dare to allow more areas here!
+    throw new file_exception('error');
+}
+
 $fs = get_file_storage();
 
 $totalsize = 0;