Users can see upload destinations they don't have access to and get an inaccurate error when uploading

[murtaugh]

I have an upload destination only admins can upload to. When a non-admin uses a field that allows uploads to any destination, they can see the forbidden destination in the dropdown within the dropzone. (The dropdown associated with the "upload new" button correctly hides it.)

When they try to upload a file to the forbidden destination, they get the following message:

Unexpected error. Check your post_max_size setting in your PHP configuration.

[murtaugh]

I'm doing some more poking around, and when a field only has one destination, and the field's destination shouldn't allow my member role to upload, the dropzone shows the same behavior as above (without the drop down).

The "Upload New" button gives the awkward but helpful You are not authorized to access this page message.

[intoeetive]

I have been able to replicate the issue.

The users are not able to upload to the destination they don't have access to - however I agree that the the non-allowed destinations should not be shown, or at least should be greyed out.

Also You are not authorized to access this page is not entirely correct, something like You are not authorized to access this upload destination should be more helpful