Your custom code (non Zen Cart) at /upload/index.php will be handling whatever you're doing with that iFrame.
Similarly, if you are attempting to regulate things with .htaccess, then you'll have to do that in that folder as well.