diff --git a/server/upload.go b/server/upload.go
index 437528b..3028070 100644
--- a/server/upload.go
+++ b/server/upload.go
@@ -1,13 +1,17 @@
 package server
 
 import (
+	"context"
 	"encoding/base64"
 	"errors"
+	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
+	"strconv"
+	"time"
 
 	"git.lastassault.de/speatzle/morffix/constants"
 )
@@ -18,30 +22,56 @@ func handleUpload(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	id := r.PathValue("id")
-	if id == "" {
+	strid := r.PathValue("id")
+	if strid == "" {
 		http.Error(w, "No id", http.StatusBadRequest)
 		return
 	}
 
-	var count int
-	err := db.QueryRow(r.Context(), "SELECT COUNT(*) FROM tasks WHERE file_id = $1 AND worker_id = $2", id, r.Header.Get(constants.UUID_HEADER)).Scan(&count)
+	id, err := strconv.Atoi(strid)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Query Task Count", "err", err)
-		http.Error(w, "Error Query Task Count: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, 0, "Convert File ID to int", err)
 		return
 	}
 
-	if count < 1 {
-		slog.ErrorContext(r.Context(), "No Running Task for file", "id", id)
-		http.Error(w, "No Running Task for file: "+id, http.StatusBadRequest)
+	if r.Header.Get(constants.WORKER_VERSION_HEADER) != constants.WORKER_VERSION {
+		http.Error(w, "Wrong Worker Version", http.StatusBadRequest)
+		return
+	}
+
+	taskid, err := strconv.Atoi(r.Header.Get(constants.TASK_ID_HEADER))
+	if err != nil {
+		errorUpload(r, w, 0, "Convert Task ID to int", err)
+		return
+	}
+
+	var fileid int
+	var workerid string
+	var status constants.TaskStatus
+	err = db.QueryRow(r.Context(), "SELECT file_id, worker_id, status FROM files WHERE id = $1", taskid).Scan(&fileid, &workerid, &status)
+	if err != nil {
+		errorUpload(r, w, 0, "Getting Task for Upload", err)
+		return
+	}
+
+	if workerid != r.Header.Get(constants.UUID_HEADER) {
+		errorUpload(r, w, taskid, "Worker is not Assigned to Task", err)
+		return
+	}
+
+	if fileid != id {
+		errorUpload(r, w, taskid, "File is not for this Task", err)
+		return
+	}
+
+	if !(status == constants.TASK_STATUS_RUNNING || status == constants.TASK_STATUS_UNKNOWN) {
+		errorUpload(r, w, taskid, "File can only be uploaded when task status is running or unknown", err)
 		return
 	}
 
 	hash, err := base64.StdEncoding.DecodeString(r.Header.Get(constants.HASH_HEADER))
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Decode Hash", "err", err)
-		http.Error(w, "Decode Hash: "+err.Error(), http.StatusBadRequest)
+		errorUpload(r, w, taskid, "Decode Hash", err)
 		return
 	}
 
@@ -49,8 +79,7 @@ func handleUpload(w http.ResponseWriter, r *http.Request) {
 	var libraryID int
 	err = db.QueryRow(r.Context(), "SELECT path, library_id FROM files WHERE id = $1", id).Scan(&fPath, &libraryID)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Query File Path", "err", err)
-		http.Error(w, "Error Query File Path: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, taskid, "Query File Path", err)
 		return
 	}
 
@@ -59,17 +88,14 @@ func handleUpload(w http.ResponseWriter, r *http.Request) {
 	var tReplace bool
 	err = db.QueryRow(r.Context(), "SELECT path, transcode_path, transcode_replace FROM libraries WHERE id = $1", libraryID).Scan(&lPath, &tPath, &tReplace)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Query Library Path", "err", err)
-		http.Error(w, "Error Query Library Path: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, taskid, "Query Library Path", err)
 		return
 	}
 
+	// When replacing, send to temp, otherwise write directly
 	var path string
 	if tReplace {
-		//path = filepath.Join(lPath, fPath)
-		slog.ErrorContext(r.Context(), "Replace mode is not implemented")
-		http.Error(w, "Replace mode is not implemented", http.StatusNotImplemented)
-		return
+		path = filepath.Join(lPath, fPath+constants.TEMP_FILE_EXTENSION)
 	} else {
 		path = filepath.Join(tPath, fPath)
 	}
@@ -78,15 +104,13 @@ func handleUpload(w http.ResponseWriter, r *http.Request) {
 
 	err = r.ParseMultipartForm(100 << 20)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Parse Multipart Form", "err", err)
-		http.Error(w, "Parse Multipart Form: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, taskid, "Parse Multipart Form", err)
 		return
 	}
 
 	srcFile, _, err := r.FormFile(constants.FORM_FILE_KEY)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Parse Multipart Form", "err", err)
-		http.Error(w, "Parse Multipart Form: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, taskid, "Form File", err)
 		return
 	}
 
@@ -94,17 +118,18 @@ func handleUpload(w http.ResponseWriter, r *http.Request) {
 	// MaxBytesReader closes the underlying io.Reader on its Close() is called
 	defer src.Close()
 
-	err = os.MkdirAll(filepath.Dir(path), 0775)
-	if err != nil {
-		slog.ErrorContext(r.Context(), "Creating Folder", "err", err)
-		http.Error(w, "Creating Folder: "+err.Error(), http.StatusInternalServerError)
-		return
+	// if we are not replacing then we dont know if the destination folder exists
+	if !tReplace {
+		err = os.MkdirAll(filepath.Dir(path), 0775)
+		if err != nil {
+			errorUpload(r, w, taskid, "Creating Folder", err)
+			return
+		}
 	}
 
 	out, err := os.Create(path)
 	if err != nil {
-		slog.ErrorContext(r.Context(), "Creating File", "err", err)
-		http.Error(w, "Creating File: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, taskid, "Creating File", err)
 		return
 	}
 	defer out.Close()
@@ -113,17 +138,58 @@ func handleUpload(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		var maxBytesError *http.MaxBytesError
 		if errors.As(err, &maxBytesError) {
-			slog.ErrorContext(r.Context(), "Parse Multipart Form", "err", err)
-			http.Error(w, "Parse Multipart Form: "+err.Error(), http.StatusRequestEntityTooLarge)
+			slog.ErrorContext(r.Context(), "File to Large", "err", err)
+			http.Error(w, "File to Large: "+err.Error(), http.StatusRequestEntityTooLarge)
 			return
 		}
-		slog.ErrorContext(r.Context(), "Failed to write the uploaded content", "err", err)
-		http.Error(w, "Failed to write the uploaded content: "+err.Error(), http.StatusInternalServerError)
+		errorUpload(r, w, taskid, "Failed to write the uploaded content", err)
 		return
 	}
 
-	// TODO check file integrity
-	_ = hash
-
 	slog.InfoContext(r.Context(), "upload done", "written", written)
+
+	out.Close()
+
+	// if we are replacing, then we need to change the original file to the uploaded file and update the hash in the database
+	if tReplace {
+		tx, err := db.Begin(r.Context())
+		if err != nil {
+			errorUpload(r, w, taskid, "Begin Transaction", err)
+			return
+		}
+
+		_, err = tx.Exec(r.Context(), "UPDATE files SET hash = $2 WHERE id = $1", fileid, hash)
+		if err != nil {
+			errorUpload(r, w, taskid, "Set File Hash", err)
+			return
+		}
+
+		dstPath := filepath.Join(lPath, fPath)
+		slog.InfoContext(r.Context(), "Replacing Original file With Uploaded File", "fileid", id, "path", path, "dstPath", dstPath)
+
+		err = os.Rename(path, dstPath)
+		if err != nil {
+			errorUpload(r, w, taskid, "Replace File", err)
+			return
+		}
+
+		err = tx.Commit(r.Context())
+		if err != nil {
+			errorUpload(r, w, taskid, "Commit File Hash", err)
+			return
+		}
+
+		slog.InfoContext(r.Context(), "Original file Replaced with Uploaded File", "fileid", id, "dstPath", dstPath)
+	}
+}
+
+func errorUpload(r *http.Request, w http.ResponseWriter, taskID int, msg string, err error) {
+	slog.ErrorContext(r.Context(), msg, "err", err)
+	http.Error(w, msg+": "+err.Error(), http.StatusInternalServerError)
+	if taskID != 0 {
+		_, err2 := db.Exec(context.TODO(), "UPDATE tasks SET log = log || $2 WHERE id = $1", taskID, []string{fmt.Sprintf("%v MASTER: upload error:"+msg+":"+err.Error(), time.Now())})
+		if err != nil {
+			slog.ErrorContext(r.Context(), "Updating task log with upload error", "err", err2)
+		}
+	}
 }