'SpooledTemporaryFile' object has no attribute 'replace'
I'm guessing that data["url"] is a SpooledTemporaryFile object, not a string. Without the full stacktrace, I can't tell which line is barfing, but you probably need to change file_url = secure_filename(data["url"]) to file_url = secure_filename(data["url"].filename) or something similar.