Thank you @ctgraham and @asmecher , your response helps me understand more the benefit of system file permission restriction ( a precaution ). But the definitive solution is to keep the files directory outside of the web root. A related post here:
Again thanks all!
D.