feat: make sure user has file_create permission and save policy on source when downloading an image

Resolves #41

Author: theboxer

core/components/modai/src/API/Download/Image.php

@@ -20,6 +20,10 @@ public function post(ServerRequestInterface $request): void
             throw APIException::unauthorized();
         }
 
+        if (!$this->modx->hasPermission('file_create')) {
+            throw APIException::unauthorized();
+        }
+
         $data = $request->getParsedBody();
 
         $url = $this->modx->getOption('url', $data);
@@ -79,6 +83,10 @@ public function post(ServerRequestInterface $request): void
             throw new LexiconException('modai.error.source_init failed');
         }
 
+        if (!$source->checkPolicy('create')) {
+            throw APIException::unauthorized();
+        }
+
         $path = Settings::getImageSetting($this->modx, $field, 'path');
         $filePath = $this->createFilePath($path, $resource);