--- a/farol/main.py	Tue Sep 30 16:23:03 2014 +0200
+++ b/farol/main.py	Tue Sep 30 16:27:42 2014 +0200
@@ -93,11 +93,7 @@
     except urllib2.HTTPError as e:
         flash('Unable to retrieve %s: %s' % (url, e))
         return
-    try: doc = parse(content)
-    except ET.ParseError as e:
-        flash('Unable to parse %s: %s' % (url, e))
-        return
-    set_current(doc)
+    set_text(content)
 
 def set_RHSA(id_):
     # validate input
@@ -132,6 +128,13 @@
         return
     set_url("http://tools.cisco.com/security/center/contentxml/CiscoSecurity%(kind)s/cisco-%(id)s/cvrf/cisco-%(id)s_cvrf.xml" % {'kind': kind, 'id': id_})
 
+def set_text(text):
+    try: doc = parse(content)
+    except ET.ParseError as e:
+        flash('Unable to parse %s: %s' % (url, e))
+        return
+    set_current(doc)
+
 @app.route('/new', methods=['GET', 'POST'])
 def new():
     if request.method != 'POST':
@@ -153,13 +156,14 @@
         if not upload.filename.endswith('.xml'):
             flash('Uploaded files should end in .xml', 'danger')
             return redirect(url_for('new'))
-        fpath = os.path.join('/tmp', secure_filename(upload.filename))
+        fpath = os.path.join(app.instance_path, 'tmp',
+                             secure_filename(upload.filename))
         upload.save(fpath)
         with open(fpath, 'rt') as f:
-            set_current(parse(f))
+            set_text(f.read())
         os.remove(fpath)
     elif 'text' in request.form:
-        set_current(parse(request.form['text'].encode('utf-8')))
+        set_text(request.form['text'].encode('utf-8'))
     else:
         set_current(CVRF(request.form['title'], request.form['type']))
     return redirect(url_for('document.view'))