this is quite a security issue. anybody can upload without any restrictions. as noted on https://github.com/symfony-cmf/CreateBundle/pull/60#discussion_r5789438 we should move the access check over to here. i think its the responsibility of the controller to check permissions, not of the editor helper.

image upload is going through this method as well, right? if not we need to add the check there as well.