Image Gallery: Make sure the user has access to the selected folder

Bug 1236636

Change-Id: I69deb64a5113806ec89145c1213f6a1d10038d78
Signed-off-by: Aaron Wells <aaronw@catalyst.net.nz>

htdocs/artefact/file/blocktype/gallery/lib.php

@@ -592,6 +592,15 @@ class PluginBlocktypeGallery extends PluginBlocktype {
                 }
             }
         }
+
+        if (!empty($values['folder'])) {
+            $folder = artefact_instance_from_id($values['folder']);
+            if (!($folder instanceof ArtefactTypeFolder) || !$USER->can_publish_artefact($folder)) {
+                $result['message'] = get_string('unrecoverableerror', 'error');
+                $form->set_error(null, $result['message']);
+                $form->reply(PIEFORM_ERR, $result);
+            }
+        }
     }
 
     public static function instance_config_save($values) {