It’s probably best to not change core files, because those will be gone when you update Cockpit to a newer version.
Instead, create a file config/api/assets/upload.php and put the code you wrote in there. It may need some alteration to make it work from there though.
I’m not a guru at all, I’ve only learned about these things recently: Get list of unpublished items through API - #8 by witsec.