Hi,
Yes you're using the ajax mode.
It means that the files are not upload in the same time but the interesting thing is that you can change dynamically the destination folder during the upload (and also refuse an upload if the destination folder is too big).
HikaMarket already use such kind of rules for the vendors (to change the destination folder ; there is no folder limitation for the moment but it's planned).
The idea is to have a specific folder for each user, so it requires that the users are log-in ; otherwise the guest accounts would all have the same folder and it will be problematic.
All the upload in the front-end is manage by the "upload controller" (components/com_hikashop/controllers/upload.php) and this controller can call the "base controller" in order to have some details about the current uploading.
In HikaShop, the item/order custom fields are managed by the controller order.
You'll find two functions in the order controller : "getUploadSetting" and "manageUpload".
The first one is to get the upload rules (like the upload destination folder) and the second one is to manage the uploaded file after his upload.
In your case, I think the best is to change the upload destination folder
$options = array(
'upload_dir' => $config->get('uploadsecurefolder')
);
to use a sub directory depending the current user id.
And you can also check the size of the folder and return a "false" if this folder is too big.
Hope my explanations are clear enough and will help you.
Regards,